diff --git a/deployment/helm/datamate/charts/ray-cluster/templates/worker-networkpolicy.yaml b/deployment/helm/datamate/charts/ray-cluster/templates/worker-networkpolicy.yaml
new file mode 100644
index 000000000..de9175ae9
--- /dev/null
+++ b/deployment/helm/datamate/charts/ray-cluster/templates/worker-networkpolicy.yaml
@@ -0,0 +1,21 @@
+{{- if and .Values.workerNetworkPolicy.enabled .Values.workerNetworkPolicy.blockedCIDRs }}
+apiVersion: crd.projectcalico.org/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "ray-cluster.fullname" . }}-worker-egress
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ray-cluster.labels" . | nindent 4 }}
+spec:
+  selector: ray.io/node-type == "worker"
+  types:
+    - Egress
+  egress:
+    - action: Deny
+      destination:
+        nets:
+{{- range .Values.workerNetworkPolicy.blockedCIDRs }}
+          - {{ . }}
+{{- end }}
+    - action: Allow
+{{- end }}
diff --git a/deployment/helm/datamate/charts/ray-cluster/values.yaml b/deployment/helm/datamate/charts/ray-cluster/values.yaml
index 58752d02e..f519da661 100644
--- a/deployment/helm/datamate/charts/ray-cluster/values.yaml
+++ b/deployment/helm/datamate/charts/ray-cluster/values.yaml
@@ -16,6 +16,12 @@ fullnameOverride: "datamate-raycluster"
 imagePullSecrets: []
 # - name: an-existing-secret
 
+workerNetworkPolicy:
+  enabled: false
+  # CIDRs to block from Ray worker pod egress. Use /32 for a single IPv4 address.
+  blockedCIDRs: []
+  # - 192.0.2.10/32
+
 # common defined values shared between the head and worker
 common:
   # containerEnv specifies environment variables for the Ray head and worker containers.
diff --git a/deployment/helm/datamate/values.yaml b/deployment/helm/datamate/values.yaml
index d00d73ba9..e75725a92 100644
--- a/deployment/helm/datamate/values.yaml
+++ b/deployment/helm/datamate/values.yaml
@@ -302,6 +302,10 @@ runtime:
 
 ray-cluster:
   enabled: true
+  workerNetworkPolicy:
+    enabled: true
+    # Use CIDR notation, for example 192.0.2.10/32 for a single IPv4 address.
+    blockedCIDRs: []
   head:
     nodeSelector: {}
     tolerations: []