diff --git a/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml b/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml
index 23006b509..eed57dcd3 100644
--- a/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml
+++ b/bundle/rhdh/manifests/rhdh-default-config_v1_configmap.yaml
@@ -430,6 +430,13 @@ data:
         - ports:
             - port: 443
               protocol: TCP
+            # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms
+            # use 443 above). Needed by plugins that query cluster resources: Tekton,
+            # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider
+            # or frontend plugin that lists or watches Kubernetes objects.
+            # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy.
+            - port: 6443
+              protocol: TCP
 
     ---
     # Redis is part of the recommended checklist for production deployments
diff --git a/config/profile/rhdh/default-config/networkpolicy.yaml b/config/profile/rhdh/default-config/networkpolicy.yaml
index b58ba4016..e4f571c88 100644
--- a/config/profile/rhdh/default-config/networkpolicy.yaml
+++ b/config/profile/rhdh/default-config/networkpolicy.yaml
@@ -52,6 +52,13 @@ spec:
     - ports:
         - port: 443
           protocol: TCP
+        # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms
+        # use 443 above). Needed by plugins that query cluster resources: Tekton,
+        # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider
+        # or frontend plugin that lists or watches Kubernetes objects.
+        # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy.
+        - port: 6443
+          protocol: TCP
 
 ---
 # Redis is part of the recommended checklist for production deployments
diff --git a/dist/rhdh/install.yaml b/dist/rhdh/install.yaml
index 7c569491f..4b8e7f492 100644
--- a/dist/rhdh/install.yaml
+++ b/dist/rhdh/install.yaml
@@ -3255,6 +3255,13 @@ data:
         - ports:
             - port: 443
               protocol: TCP
+            # Kubernetes API server (e.g., OpenShift uses 6443; some managed platforms
+            # use 443 above). Needed by plugins that query cluster resources: Tekton,
+            # ArgoCD/GitOps, Topology, KServe model catalog, and any catalog provider
+            # or frontend plugin that lists or watches Kubernetes objects.
+            # RBAC on the ServiceAccount is the access-control boundary, not NetworkPolicy.
+            - port: 6443
+              protocol: TCP
 
     ---
     # Redis is part of the recommended checklist for production deployments
diff --git a/docs/configuration.md b/docs/configuration.md
index ad6f1f744..18c43d791 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -230,6 +230,7 @@ For example, Backstage CR named **mybackstage** will create K8s Deployment resou
     - DB-scoped policies are filtered out when `spec.database.enableLocalDb` is `false`
     - When local DB is disabled, the `allow-psql-egress` policy allows egress on port 5432 to any destination (for external databases)
     - The `allow-redis-egress` policy allows egress on port 6379 TCP to any destination (Redis is not deployed by the operator; users bring their own)
+    - The `allow-https-egress` policy also allows egress on port 6443 TCP (Kubernetes API server) — needed by plugins that query cluster resources (Tekton, ArgoCD/GitOps, Topology, KServe model catalog, etc.). On some managed platforms (GKE, EKS) the API server listens on port 443 instead.
     - The `allow-metrics-ingress` policy allows ingress on port 9464 from `openshift-monitoring`, `openshift-user-workload-monitoring`, GKE GMP namespaces (`gmp-system`, `gke-gmp-system`), and `monitoring` (kube-prometheus-stack convention)
     - On OpenShift, the `allow-router-ingress` policy's `namespaceSelector` is set to `policy-group.network.openshift.io/ingress: ""`
 
diff --git a/docs/intelligent-assistant-okp-kubernetes.md b/docs/intelligent-assistant-okp-kubernetes.md
index f8f03454a..ceee2a9d7 100644
--- a/docs/intelligent-assistant-okp-kubernetes.md
+++ b/docs/intelligent-assistant-okp-kubernetes.md
@@ -80,7 +80,7 @@ spec:
                   number: 8080
 ```
 
-The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP port 443. The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`.
+The default RHDH NetworkPolicies already allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). The OKP add-on additionally allows HTTP egress on ports 80 and 8080. If you replace the default policies, ensure that the replacement permits the port used by `OKP_SERVICE_URL`.
 
 ## Configure the public OKP URL
 
diff --git a/docs/intelligent-assistant-okp-openshift.md b/docs/intelligent-assistant-okp-openshift.md
index a2f499ada..f994937c9 100644
--- a/docs/intelligent-assistant-okp-openshift.md
+++ b/docs/intelligent-assistant-okp-openshift.md
@@ -51,7 +51,7 @@ The ConfigMap contains only a public CA certificate. Do not copy the router Secr
 
 ### Verify HTTPS egress
 
-The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP port 443. If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route.
+The default RHDH NetworkPolicies allow HTTPS egress from the Backstage pod on TCP ports 443 and 6443 (Kubernetes API server). If you replace the default policies, ensure that the replacement permits HTTPS access to the OKP Route.
 
 ### Mount and trust the CA