diff --git a/apps/ollama/base/kustomization.yaml b/apps/ollama/base/kustomization.yaml
index 31d547e..76b547f 100644
--- a/apps/ollama/base/kustomization.yaml
+++ b/apps/ollama/base/kustomization.yaml
@@ -4,4 +4,5 @@ resources:
   - namespace.yaml
   - pvc.yaml
   - deployment.yaml
-  - service.yaml
\ No newline at end of file
+  - service.yaml
+  - networkpolicy.yaml
\ No newline at end of file
diff --git a/apps/ollama/base/networkpolicy.yaml b/apps/ollama/base/networkpolicy.yaml
new file mode 100644
index 0000000..4d37139
--- /dev/null
+++ b/apps/ollama/base/networkpolicy.yaml
@@ -0,0 +1,53 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ollama-ingress-restriction
+  namespace: nxtgauge-ai
+  labels:
+    app: ollama
+spec:
+  podSelector:
+    matchLabels:
+      app: ollama
+  policyTypes:
+    - Ingress
+  ingress:
+    # Allow traffic from users service (port 11434)
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: users
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from payments service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: default
+          podSelector:
+            matchLabels:
+              app: payments
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from nxtgauge-ai-assistant service
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: nxtgauge-ai
+          podSelector:
+            matchLabels:
+              app: nxtgauge-ai-assistant
+      ports:
+        - protocol: TCP
+          port: 11434
+    # Allow traffic from within the same namespace (for health checks, etc.)
+    - from:
+        - podSelector: {}
+      ports:
+        - protocol: TCP
+          port: 11434