diff --git a/CHANGELOG.md b/CHANGELOG.md
index 769b597ba..ba85ae335 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Sandbox environments now automatically allow and authenticate their repository's git platform (GitLab/GitHub) for git operations over HTTPS in the sandbox. DAIV injects an `Authorization: Basic` credential at the egress proxy, built from a short-lived token — the same project-scoped ephemeral clone token for GitLab, and a `contents:write` installation token for GitHub — so `git fetch`/clone/push of the repository works without configuring a per-environment host rule. Because DAIV pushes from inside the sandbox, this applies even to **Network Off** environments when a push token exists: the environment is opened solely for its git platform (everything else stays blocked) so publishing always works, while token-less eval/benchmark runs stay fully network-isolated. The rule is applied at runtime (never stored on the environment) and takes precedence over a user-defined rule for the same host.
+- Added a per-environment **network egress policy** for sandbox environments, configurable from the environment form when network is enabled. Restrict outbound traffic to an allow-list of hosts (glob patterns), attach per-host HTTP credentials (header name + value, encrypted at rest and never rendered back), scope each host to **all methods** or **read-only** (`GET, HEAD, OPTIONS`), and set the `default` (deny/allow) reachability for unlisted hosts. The proxy always TLS-inspects every reachable host, so per-host credentials and method rules are always enforced. Credentials are injected by the daiv-sandbox egress proxy and never enter the sandbox container. The egress proxy is mandatory for network-enabled sessions: if the sandbox deployment has no egress proxy configured, a network-enabled run is rejected rather than falling back to unrestricted network.
 - Added `release_orphan_queued_threads` management command to recover `QUEUED` activities left behind on threads with no active sibling (rare TOCTOU loss).
 - Added per-domain auth headers for the `web_fetch` tool to the configuration UI under **Web Fetch → Per-domain auth headers**. Each row pairs a domain (exact match) with an HTTP header name and a header value (encrypted at rest). Replaces the previous env-only `AUTOMATION_WEB_FETCH_AUTH_HEADERS` setting; the new env override is `DAIV_WEB_FETCH_AUTH_HEADERS` (same JSON shape). Operators using the old name must rename it.
 - Added a "Start a run" page at `/dashboard/runs/new/` for launching new agent runs from the UI, and a "Retry" button on terminal non-webhook activities that pre-fills the form with the original prompt, repository, ref, and max-mode flag.
@@ -36,10 +38,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added support for custom global skills available across all repositories. Mount skill directories to `/home/daiv/data/skills/` (configurable via `DAIV_AGENT_CUSTOM_SKILLS_PATH`). Custom global skills follow the same format as built-in skills and can override them.
 - Added deferred tool loading for the agent, reducing the number of tools visible to the model at startup and loading additional tools on demand based on the task context.
 
+### Changed
+
+- **Upgrade note — existing network-enabled sandbox environments become network-isolated.** The legacy `network_enabled` flag is replaced by the per-environment egress policy (network is now derived from the presence of a policy). There is no automatic conversion: the migration leaves every previously network-enabled environment without a policy, so after upgrade those environments run network-isolated. The repository's own git platform stays reachable (DAIV injects it at runtime, so runs still clone and publish), but any other outbound access — package registries, external APIs — is blocked until an operator re-enables it by setting **Network** to **On** and defining an egress allow-list. This is deliberate: the new model has no unrestricted-network mode, and auto-granting allow-all would fail closed on deployments without the egress proxy CA configured.
+
 ### Fixed
 
 - Hardened the agent's workspace file tools (`read_file`/`write_file`/`edit_file`/`ls`/`glob`/`grep`) against sandbox transport faults: a transient failure — most notably the `409 "Session is busy"` the sandbox returns when batched tool calls contend on the one-at-a-time session — now degrades to a retryable tool-result error instead of aborting the whole run, matching the `bash` tool. The `bash` tool's own classifier now also treats `409` as transient (retry once) rather than permanent.
 - Hardened MCP tool loading so a single broken or slow MCP server can no longer freeze chats and runs. Each server's tools are now loaded independently with a per-server timeout (`MCP_TOOL_LOAD_TIMEOUT`, default 30s); a server that times out or errors is skipped instead of blocking the whole agent.
+- GitLab clones now self-heal from a stale cached clone token. The short-lived project-scoped clone token is cached for a day, but the underlying project access token can die sooner (revoked, or the project/instance reset); previously the dead token was served to — and failed — every clone of that project until the cache window closed. A clone rejected for authentication while using the ephemeral token now drops it and retries once with a freshly minted one (the PAT fallback is not retried, since re-minting cannot change that credential).
 - Enforced "at most one active (`READY`/`RUNNING`) API/MCP Activity per `thread_id`" at the DB layer via a partial unique constraint. Concurrent submissions on the same thread cleanly fall back to `QUEUED` instead of both running.
 - Made the FIFO dispatcher race-safe: an atomic compare-and-swap (`UPDATE filter(status=QUEUED) → READY`) prevents two terminal events on the same thread from double-promoting the same queued sibling. Dispatch failures now set `finished_at` and iterate via a loop instead of recursive signal re-entry. The loop bails after `MAX_CONSECUTIVE_DISPATCH_FAILURES` (3) consecutive failures so a transient broker outage does not mass-fail an entire QUEUED backlog — remaining rows stay QUEUED for `release_orphan_queued_threads`.
 - Guarded the post-enqueue `task_result_id` save in both `asubmit_batch_runs` and `dispatch_next_in_thread`: a DB blip after a successful broker enqueue now marks the row FAILED (and releases queued siblings) instead of stranding it in READY with no task linkage.
diff --git a/daiv/accounts/templates/accounts/_sidebar.html b/daiv/accounts/templates/accounts/_sidebar.html
index ab3cc78da..4f8b23288 100644
--- a/daiv/accounts/templates/accounts/_sidebar.html
+++ b/daiv/accounts/templates/accounts/_sidebar.html
@@ -1,7 +1,7 @@
 {% load i18n icon_tags nav_tags %}
 
 <aside data-testid="app-sidebar"
-       class="hidden w-60 shrink-0 overflow-y-auto border-r border-white/[0.06] bg-[#030712] sm:flex sm:flex-col"
+       class="shrink-0 overflow-y-auto bg-[#030712] {{ sidebar_root_class|default:'hidden w-60 border-r border-white/[0.06] sm:flex sm:flex-col' }}"
        x-cloak>
   <div class="flex items-center gap-2.5 px-5 pt-5 pb-5">
     <span class="inline-block h-6 w-6 rounded-md bg-gradient-to-br from-violet-500 to-indigo-500"></span>
diff --git a/daiv/accounts/templates/base_app.html b/daiv/accounts/templates/base_app.html
index 48501e7b8..4448a230c 100644
--- a/daiv/accounts/templates/base_app.html
+++ b/daiv/accounts/templates/base_app.html
@@ -17,7 +17,7 @@
          x-transition:leave-start="translate-x-0"
          x-transition:leave-end="-translate-x-full"
          class="relative flex h-full w-[85%] max-w-[260px] flex-col bg-[#030712] shadow-2xl">
-      {% include "accounts/_sidebar.html" %}
+      {% include "accounts/_sidebar.html" with sidebar_root_class="flex w-full flex-col" %}
     </div>
   </div>
 
diff --git a/daiv/automation/agent/git_manager.py b/daiv/automation/agent/git_manager.py
index 0ac864c15..9ecf347ea 100644
--- a/daiv/automation/agent/git_manager.py
+++ b/daiv/automation/agent/git_manager.py
@@ -10,6 +10,7 @@
 from git import GitCommandError
 
 from automation.agent.constants import REPO_PATH
+from core.utils import is_git_auth_error_text
 
 if TYPE_CHECKING:
     from git import Repo
@@ -366,31 +367,14 @@ class GitPushPermissionError(RuntimeError):
 class GitPushNetworkError(RuntimeError):
     """Raised when pushing fails because the remote host is unreachable.
 
-    Typically a sandbox-authoritative run whose sandbox environment is configured with
-    ``network_enabled=False``: git runs (and therefore pushes) from inside the sandbox, so the
-    sandbox must have network access for the push to reach ``origin``.
+    git runs (and therefore pushes) from inside the sandbox, so the sandbox must be able to reach
+    ``origin``'s git platform. DAIV opens that host automatically whenever a platform token can be
+    minted — even on a network-off env — so this typically means the egress proxy is unavailable, or
+    the run is one that legitimately has no platform token (e.g. an eval/benchmark run) and so stays
+    fully network-isolated.
     """
 
 
-def _is_push_auth_error_text(output: str) -> bool:
-    """
-    Check if git push output indicates an authentication or permission failure.
-    """
-    text = output.lower()
-    return any(
-        marker in text
-        for marker in (
-            "returned error: 403",
-            "authentication failed",
-            "permission denied",
-            "access denied",
-            "http basic: access denied",
-            "could not read username",
-            "not authorized",
-        )
-    )
-
-
 def _is_push_network_error_text(output: str) -> bool:
     """Check if git push output indicates the remote host was unreachable (network failure).
 
@@ -420,7 +404,7 @@ def _raise_for_push_failure(push_args: list[str], result: _GitResult) -> None:
     Auth/permission → ``GitPushPermissionError``; an unreachable host → ``GitPushNetworkError``;
     anything else → the raw ``GitCommandError``. Auth is checked first so it always wins.
     """
-    if _is_push_auth_error_text(result.output):
+    if is_git_auth_error_text(result.output):
         logger.warning("git push auth failure: %s", result.output)
         raise GitPushPermissionError(
             "Failed to push changes to the remote repository due to authentication or permission issues. "
@@ -432,7 +416,7 @@ def _raise_for_push_failure(push_args: list[str], result: _GitResult) -> None:
         logger.warning("git push network failure: %s", result.output)
         raise GitPushNetworkError(
             "Failed to push changes: the remote host is unreachable. Sandbox-authoritative auto-commit "
-            "pushes from inside the sandbox, so the sandbox environment must run with network access "
-            "(network_enabled=True)."
+            "pushes from inside the sandbox, so the sandbox environment must run as an egress-enabled "
+            "sandbox."
         )
     raise GitCommandError(["git", *push_args], result.exit_code, result.output)
diff --git a/daiv/automation/agent/middlewares/sandbox.py b/daiv/automation/agent/middlewares/sandbox.py
index 2f0671efc..0e2009efb 100644
--- a/daiv/automation/agent/middlewares/sandbox.py
+++ b/daiv/automation/agent/middlewares/sandbox.py
@@ -291,6 +291,21 @@ def _make_global_skills_archive() -> bytes | None:
     return buf.getvalue()
 
 
+class SandboxEgressUnavailableError(RuntimeError):
+    """Raised when a session's resolved egress policy cannot be provisioned because the sandbox has
+    no egress proxy configured (no shared egress CA). daiv-sandbox rejects such a session up front
+    with HTTP 400 and a detail naming the egress proxy (see its ``POST /session/`` handler).
+    Fail-closed: an environment that requires a restricted egress policy must not run without that
+    policy in force."""
+
+
+# Substring that distinguishes the "egress proxy not configured" 400 from any other create-time 400.
+# Couples to daiv-sandbox's FastAPI ``detail`` ("egress requires the egress proxy, which is not
+# configured on this deployment" — its ``POST /session/`` handler). The sandbox exposes no
+# machine-readable error code, so this is the single greppable point of that prose coupling.
+_EGRESS_PROXY_UNAVAILABLE_MARKER = "egress proxy"
+
+
 class BashFailure(Enum):
     """Why a bash invocation produced no result, mapped to the guidance the agent gets.
 
@@ -522,15 +537,32 @@ async def abefore_agent(self, state: StateT, runtime: Runtime[RuntimeCtx]) -> di
             return {"session_id": prior_session_id}
 
         sb = runtime.context.sandbox
-        session_id = await client.start_session(
-            StartSessionRequest(
-                base_image=sb.base_image,
-                network_enabled=sb.network_enabled,
-                memory_bytes=sb.memory_bytes,
-                cpus=sb.cpus,
-                environment=sb.env_vars or None,
+        try:
+            session_id = await client.start_session(
+                StartSessionRequest(
+                    base_image=sb.base_image,
+                    egress=sb.egress,
+                    memory_bytes=sb.memory_bytes,
+                    cpus=sb.cpus,
+                    environment=sb.env_vars or None,
+                )
             )
-        )
+        except httpx.HTTPStatusError as exc:
+            # A network-enabled env on a sandbox with no egress proxy (no shared CA) is rejected up
+            # front with HTTP 400 (see _EGRESS_PROXY_UNAVAILABLE_MARKER). Match that specific signal so
+            # an unrelated 400 (e.g. an invalid base image) re-raises as-is instead of being mislabelled.
+            detail = (exc.response.text or "").lower()
+            if exc.response.status_code == 400 and _EGRESS_PROXY_UNAVAILABLE_MARKER in detail:
+                logger.error(
+                    "Sandbox rejected egress-required session (400): the egress proxy/CA is not configured "
+                    "on the sandbox deployment. Aborting run (fail-closed)."
+                )
+                raise SandboxEgressUnavailableError(
+                    "The resolved sandbox environment requires the egress proxy, but the sandbox rejected "
+                    "the session (400). Configure the shared egress CA (DAIV_SANDBOX_EGRESS_CA_CERT_FILE + "
+                    "DAIV_SANDBOX_EGRESS_CA_KEY_FILE) on the sandbox deployment to enable the egress proxy."
+                ) from exc
+            raise
         try:
             working_dir = Path(runtime.context.gitrepo.working_dir)
             repo_archive, skills_archive = await asyncio.gather(
@@ -538,6 +570,7 @@ async def abefore_agent(self, state: StateT, runtime: Runtime[RuntimeCtx]) -> di
             )
             await client.seed_session(session_id, repo_archive=repo_archive, skills_archive=skills_archive)
         except Exception:
+            # Build/seed failure on an already-created session (the egress-unavailable case fails earlier).
             logger.exception("Failed to build or seed sandbox session %s", session_id)
             try:
                 await client.close_session(session_id, force=True)
diff --git a/daiv/codebase/clients/base.py b/daiv/codebase/clients/base.py
index 5bc87e7ac..2833ec85e 100644
--- a/daiv/codebase/clients/base.py
+++ b/daiv/codebase/clients/base.py
@@ -1,13 +1,17 @@
 from __future__ import annotations
 
 import abc
+import base64
 import functools
 import logging
 from contextlib import contextmanager
+from dataclasses import dataclass
 from enum import StrEnum
 from functools import cached_property
 from typing import TYPE_CHECKING, Any
 
+from pydantic import SecretStr
+
 from codebase.base import (
     Discussion,
     GitPlatform,
@@ -41,6 +45,29 @@ class WebhookSetupResult(StrEnum):
     SKIPPED = "skipped"
 
 
+@dataclass(frozen=True)
+class GitEgressCredential:
+    """Egress-proxy contribution for a repo's git platform: which host to allow and the
+    ``Authorization`` header to inject so git-over-HTTPS in the sandbox is authenticated.
+
+    ``value`` is ``None`` when no token could be provisioned — the host is still returned so
+    reachability works (the repo's origin remote authenticates via its ``.git/config`` token)."""
+
+    host: str
+    header: str = "Authorization"
+    value: SecretStr | None = None
+
+    @classmethod
+    def for_token(cls, *, host: str, token: str | None) -> GitEgressCredential:
+        """Build a credential injecting ``Authorization: Basic base64("oauth2:<token>")`` —
+        the same shape DAIV's clone URL uses. ``value`` is ``None`` when ``token`` is falsy."""
+        value = None
+        if token:
+            encoded = base64.b64encode(f"oauth2:{token}".encode()).decode()
+            value = SecretStr(f"Basic {encoded}")
+        return cls(host=host, value=value)
+
+
 class RepoClient(abc.ABC):
     """
     Abstract class for repository clients.
@@ -110,6 +137,26 @@ def set_repository_webhooks(
     def load_repo(self, repository: Repository, sha: str) -> Iterator[Repo]:
         pass
 
+    def get_git_egress_credential(self, repository: Repository) -> GitEgressCredential | None:
+        """Egress allow-rule + credential for this repo's git platform, or ``None`` for platforms
+        that need none. Resolved per run because the host is repo-derived and the token is
+        short-lived — never stored on the environment.
+
+        The shared shape lives here — derive the host from the clone URL, then build a
+        ``Basic oauth2:<token>`` credential. Platforms supply only the token via
+        :meth:`_git_egress_token` (overriding this method is unnecessary)."""
+        from urllib.parse import urlparse
+
+        host = urlparse(repository.clone_url).hostname
+        if not host:
+            return None
+        return GitEgressCredential.for_token(host=host, token=self._git_egress_token(repository))
+
+    def _git_egress_token(self, repository: Repository) -> str | None:
+        """Short-lived token authenticating git-over-HTTPS for this repo's platform, or ``None`` for
+        platforms that need no credential (host-only reachability). Overridden by GitLab/GitHub."""
+        return None
+
     # Issue
     @abc.abstractmethod
     def get_issue(self, repo_id: str, issue_id: int) -> Issue:
diff --git a/daiv/codebase/clients/github/client.py b/daiv/codebase/clients/github/client.py
index 48d8bcf0d..c77e8ae53 100644
--- a/daiv/codebase/clients/github/client.py
+++ b/daiv/codebase/clients/github/client.py
@@ -265,6 +265,20 @@ def load_repo(self, repository: Repository, sha: str) -> Iterator[Repo]:
             self._configure_commit_identity(repo)
             yield repo
 
+    def _git_egress_token(self, repository: Repository) -> str | None:
+        """Mint a short-lived installation token scoped to ``contents: write``.
+
+        The egress proxy injects this token over the ``Authorization`` header for *every* request to the
+        platform host (the platform rule matches all methods and forces interception), superseding the
+        token git embeds from ``.git/config``. DAIV's publish push runs from inside the sandbox and goes
+        through the same path, so the injected token must be **write**-capable or the push is rejected.
+        It matches the ``contents: write`` token used to clone. The agent is still prevented from pushing
+        ad-hoc from ``bash`` by the command policy, not by withholding write scope here."""
+        access_token = self._integration.get_access_token(
+            self.client_installation.id, permissions={"contents": "write"}
+        )
+        return access_token.token
+
     # Issue
     def get_issue(self, repo_id: str, issue_id: int) -> Issue:
         """
diff --git a/daiv/codebase/clients/gitlab/client.py b/daiv/codebase/clients/gitlab/client.py
index 2d0faa91a..603b510e3 100644
--- a/daiv/codebase/clients/gitlab/client.py
+++ b/daiv/codebase/clients/gitlab/client.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import logging
+import shutil
 import tempfile
 import time
 from contextlib import contextmanager
@@ -11,7 +12,7 @@
 
 from django.core.exceptions import ImproperlyConfigured
 
-from git import Repo
+from git import GitCommandError, Repo
 from gitlab import Gitlab, GitlabCreateError, GitlabOperationError
 from gitlab.exceptions import GitlabError
 
@@ -31,9 +32,9 @@
     User,
 )
 from codebase.clients import RepoClient
-from codebase.clients.gitlab.clone_tokens import get_ephemeral_clone_token
+from codebase.clients.gitlab.clone_tokens import get_ephemeral_clone_token, invalidate_clone_token
 from core.constants import BOT_NAME
-from core.utils import async_download_url, build_uri
+from core.utils import async_download_url, build_uri, is_git_auth_error_text
 from daiv import USER_AGENT
 
 if TYPE_CHECKING:
@@ -57,6 +58,19 @@
 MERGE_REQUEST_BRANCH_VISIBILITY_RETRY_BACKOFF_SECONDS = (1.0, 2.0, 4.0, 8.0)
 
 
+def _is_clone_auth_error(error: GitCommandError) -> bool:
+    """True when a clone failed because the remote rejected the credential (HTTP auth), as opposed
+    to a missing branch, a bad URL, or a network error.
+
+    Only auth rejections are worth retrying with a freshly minted token; everything else would fail
+    identically the second time. A clone that under-matches would silently keep serving the dead
+    cached token — the exact wedge this self-heal exists to break — so it reuses the shared marker set
+    (:func:`core.utils.is_git_auth_error_text`) the push side uses; over-matching costs at most one
+    extra (still-failing) clone attempt.
+    """
+    return is_git_auth_error_text(f"{error.stderr or ''} {error}")
+
+
 def _is_source_branch_missing_error(error: GitlabCreateError) -> bool:
     """True when GitLab rejected MR creation because the source branch isn't visible yet.
 
@@ -332,15 +346,44 @@ def load_repo(self, repository: Repository, sha: str) -> Iterator[Repo]:
         with tempfile.TemporaryDirectory(prefix=f"{safe_slug(repository.slug)}-{repository.pk}") as tmpdir:
             logger.debug("Cloning repository %s to %s", repository.clone_url, tmpdir)
 
-            parsed = urlparse(repository.clone_url)
-            clone_url = f"{parsed.scheme}://oauth2:{self._get_clone_token(repository)}@{parsed.netloc}{parsed.path}"
-
             clone_dir = Path(tmpdir) / "repo"
-            clone_dir.mkdir(exist_ok=True)
-            repo = Repo.clone_from(clone_url, clone_dir, branch=sha)
+            repo = self._clone(repository, sha, clone_dir)
             self._configure_commit_identity(repo)
             yield repo
 
+    def _clone(self, repository: Repository, sha: str, clone_dir: Path) -> Repo:
+        """
+        Clone ``repository`` at ``sha`` into ``clone_dir``, healing a stale cached clone token.
+
+        A clone token is cached for a day but the project access token behind it can die sooner
+        (revoked, project/instance reset). Because the cache is consulted before any API call, a
+        dead token would otherwise be served to — and fail — every clone of the project until the
+        cache window closes. So when a clone is rejected for auth *and* it used the ephemeral token,
+        drop that token and retry once with a freshly minted one. The PAT fallback is not retried:
+        re-minting can't produce a different credential when the ephemeral token was unavailable.
+        """
+        parsed = urlparse(repository.clone_url)
+
+        def clone_with(token: str) -> Repo:
+            clone_dir.mkdir(exist_ok=True)
+            url = f"{parsed.scheme}://oauth2:{token}@{parsed.netloc}{parsed.path}"
+            return Repo.clone_from(url, clone_dir, branch=sha)
+
+        token = self._get_clone_token(repository)
+        try:
+            return clone_with(token)
+        except GitCommandError as e:
+            if token == self.client.private_token or not _is_clone_auth_error(e):
+                raise
+            logger.warning(
+                "Clone of %s was rejected for authentication; dropping the cached ephemeral token "
+                "and retrying once with a freshly minted one.",
+                repository.slug,
+            )
+            invalidate_clone_token(repository.pk)
+            shutil.rmtree(clone_dir, ignore_errors=True)
+            return clone_with(self._get_clone_token(repository))
+
     def _get_clone_token(self, repository: Repository) -> str:
         """
         Resolve the credential embedded in the clone URL.
@@ -367,6 +410,11 @@ def _get_clone_token(self, repository: Repository) -> str:
         logger.info("Cloning %s with the configured PAT (ephemeral clone token unavailable)", repository.slug)
         return self.client.private_token
 
+    def _git_egress_token(self, repository: Repository) -> str | None:
+        """Reuse the same short-lived, project-scoped clone token as the clone (PAT fallback; see
+        :meth:`_get_clone_token`); ``None`` (host-only reachability) when neither is available."""
+        return get_ephemeral_clone_token(self.client, repository.pk) or self.client.private_token or None
+
     # Issue
     def get_issue(self, repo_id: str, issue_id: int) -> Issue:
         """
diff --git a/daiv/codebase/clients/gitlab/clone_tokens.py b/daiv/codebase/clients/gitlab/clone_tokens.py
index a26df6689..96cc41577 100644
--- a/daiv/codebase/clients/gitlab/clone_tokens.py
+++ b/daiv/codebase/clients/gitlab/clone_tokens.py
@@ -58,6 +58,18 @@ def get_ephemeral_clone_token(client: Gitlab, project_pk: int) -> str | None:
     return token
 
 
+def invalidate_clone_token(project_pk: int) -> None:
+    """
+    Evict the cached clone-token outcome for a project so the next call re-mints.
+
+    Used when a clone authenticates with the cached token yet GitLab rejects it (revoked,
+    expired, or the project/instance was reset): without eviction the dead token would be
+    served for the remainder of the cache window, failing every clone of the project. A
+    no-op when nothing is cached.
+    """
+    cache.delete(_CACHE_KEY.format(project_pk=project_pk))
+
+
 def _create_token(client: Gitlab, project_pk: int) -> tuple[str | None, int]:
     """
     Mint the project access token.
diff --git a/daiv/codebase/context.py b/daiv/codebase/context.py
index 96ee169d5..f4c556284 100644
--- a/daiv/codebase/context.py
+++ b/daiv/codebase/context.py
@@ -12,6 +12,7 @@
 from codebase.repo_config import RepositoryConfig  # noqa: TC001
 from core.sandbox.client import DAIVSandboxClient, reset_run_sandbox_client, set_run_sandbox_client
 from core.sandbox.command_policy import SandboxCommandPolicy  # noqa: TC001
+from core.sandbox.schemas import EgressConfigRequest  # noqa: TC001
 
 if TYPE_CHECKING:
     from collections.abc import AsyncIterator
@@ -33,11 +34,11 @@ class SandboxRuntime:
     """
 
     base_image: str | None
-    network_enabled: bool
     memory_bytes: int | None
     cpus: float | None
     env_vars: dict[str, str]
     command_policy: SandboxCommandPolicy
+    egress: EgressConfigRequest | None = None
 
     @property
     def enabled(self) -> bool:
@@ -145,6 +146,7 @@ async def set_runtime_ctx(
         RuntimeCtx: The runtime context
     """
     from sandbox_envs.services import (
+        augment_sandbox_with_platform_egress,
         get_global_default,
         merge_sandbox_runtime,
         resolve_env_for_run,
@@ -181,6 +183,13 @@ async def set_runtime_ctx(
 
     try:
         with repo_client.load_repo(repository, sha=ref) as repo:
+            # Always reach + authenticate the repo's git platform for git-over-HTTPS in the sandbox — DAIV
+            # pushes from inside the sandbox, so even a network-off env is opened for the platform host when
+            # a token can be minted. Runtime-only (never stored on the env); a no-op only when the sandbox is
+            # disabled, or when network is off and no platform token is available (e.g. eval runs).
+            # Resolved AFTER the clone so it sees any token the clone's self-heal re-minted (a pre-clone
+            # credential would pin the egress proxy to the stale token the clone just discarded).
+            sandbox = augment_sandbox_with_platform_egress(sandbox, repo_client, repository)
             handle = RepoHandle(
                 repo_id=repo_id,
                 git_platform=repo_client.git_platform,
diff --git a/daiv/core/sandbox/client.py b/daiv/core/sandbox/client.py
index 93605d126..e60e8c1f3 100644
--- a/daiv/core/sandbox/client.py
+++ b/daiv/core/sandbox/client.py
@@ -123,16 +123,16 @@ async def __aexit__(self, exc_type, exc, tb) -> None:
         await self.close()
 
     async def start_session(self, request: StartSessionRequest) -> str:
-        """
-        Start a session with the sandbox.
-
-        Args:
-            request (StartSessionRequest): The request to start the session.
+        """Start a session with the sandbox; returns the session ID.
 
-        Returns:
-            The session ID.
+        ``model_dump(mode="json")`` masks ``SecretStr`` egress secrets, but the sidecar needs the
+        plaintext — so the egress block is re-serialised via ``EgressConfigRequest.to_wire()`` (the
+        single source of truth for the wire shape) instead of the masked ``model_dump`` value.
         """
-        response = await self._client.post("session/", json=request.model_dump(mode="json"))
+        payload = request.model_dump(mode="json")
+        if request.egress is not None:
+            payload["egress"] = request.egress.to_wire()
+        response = await self._client.post("session/", json=payload)
         response.raise_for_status()
         return response.json()["session_id"]
 
diff --git a/daiv/core/sandbox/schemas.dump.json b/daiv/core/sandbox/schemas.dump.json
index c759c916e..3f73bbbe7 100644
--- a/daiv/core/sandbox/schemas.dump.json
+++ b/daiv/core/sandbox/schemas.dump.json
@@ -99,6 +99,253 @@
     "title": "ApplyMutationsResponse",
     "type": "object"
   },
+  "EgressConfigRequest": {
+    "$defs": {
+      "EgressPolicy": {
+        "properties": {
+          "default": {
+            "default": "deny",
+            "description": "Reachability for unlisted hosts.",
+            "enum": [
+              "deny",
+              "allow"
+            ],
+            "title": "Default",
+            "type": "string"
+          },
+          "intercept": {
+            "default": "all",
+            "description": "'all' MITMs every reachable host; 'credentialed' MITMs only inject hosts.",
+            "enum": [
+              "all",
+              "credentialed"
+            ],
+            "title": "Intercept",
+            "type": "string"
+          },
+          "rules": {
+            "items": {
+              "$ref": "#/$defs/EgressRule"
+            },
+            "title": "Rules",
+            "type": "array"
+          }
+        },
+        "title": "EgressPolicy",
+        "type": "object"
+      },
+      "EgressRule": {
+        "properties": {
+          "host": {
+            "description": "Destination host glob (e.g. 'github.com', '*.githubusercontent.com').",
+            "title": "Host",
+            "type": "string"
+          },
+          "inject": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "description": "Name of the secret whose header is injected for this host.",
+            "title": "Inject"
+          },
+          "methods": {
+            "description": "Allowed HTTP methods, or ['*'] for any.",
+            "items": {
+              "type": "string"
+            },
+            "title": "Methods",
+            "type": "array"
+          }
+        },
+        "required": [
+          "host"
+        ],
+        "title": "EgressRule",
+        "type": "object"
+      },
+      "EgressSecret": {
+        "properties": {
+          "header": {
+            "description": "Header name to set (e.g. 'Authorization', 'PRIVATE-TOKEN').",
+            "title": "Header",
+            "type": "string"
+          },
+          "value": {
+            "description": "Header value; redacted in logs/repr.",
+            "format": "password",
+            "title": "Value",
+            "type": "string",
+            "writeOnly": true
+          }
+        },
+        "required": [
+          "header",
+          "value"
+        ],
+        "title": "EgressSecret",
+        "type": "object"
+      }
+    },
+    "properties": {
+      "policy": {
+        "$ref": "#/$defs/EgressPolicy"
+      },
+      "secrets": {
+        "additionalProperties": {
+          "$ref": "#/$defs/EgressSecret"
+        },
+        "title": "Secrets",
+        "type": "object"
+      }
+    },
+    "title": "EgressConfigRequest",
+    "type": "object"
+  },
+  "EgressConfigResponse": {
+    "properties": {
+      "ok": {
+        "default": true,
+        "description": "True when the policy was provisioned to the sidecar.",
+        "title": "Ok",
+        "type": "boolean"
+      }
+    },
+    "title": "EgressConfigResponse",
+    "type": "object"
+  },
+  "EgressPolicy": {
+    "$defs": {
+      "EgressRule": {
+        "properties": {
+          "host": {
+            "description": "Destination host glob (e.g. 'github.com', '*.githubusercontent.com').",
+            "title": "Host",
+            "type": "string"
+          },
+          "inject": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "default": null,
+            "description": "Name of the secret whose header is injected for this host.",
+            "title": "Inject"
+          },
+          "methods": {
+            "description": "Allowed HTTP methods, or ['*'] for any.",
+            "items": {
+              "type": "string"
+            },
+            "title": "Methods",
+            "type": "array"
+          }
+        },
+        "required": [
+          "host"
+        ],
+        "title": "EgressRule",
+        "type": "object"
+      }
+    },
+    "properties": {
+      "default": {
+        "default": "deny",
+        "description": "Reachability for unlisted hosts.",
+        "enum": [
+          "deny",
+          "allow"
+        ],
+        "title": "Default",
+        "type": "string"
+      },
+      "intercept": {
+        "default": "all",
+        "description": "'all' MITMs every reachable host; 'credentialed' MITMs only inject hosts.",
+        "enum": [
+          "all",
+          "credentialed"
+        ],
+        "title": "Intercept",
+        "type": "string"
+      },
+      "rules": {
+        "items": {
+          "$ref": "#/$defs/EgressRule"
+        },
+        "title": "Rules",
+        "type": "array"
+      }
+    },
+    "title": "EgressPolicy",
+    "type": "object"
+  },
+  "EgressRule": {
+    "properties": {
+      "host": {
+        "description": "Destination host glob (e.g. 'github.com', '*.githubusercontent.com').",
+        "title": "Host",
+        "type": "string"
+      },
+      "inject": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "default": null,
+        "description": "Name of the secret whose header is injected for this host.",
+        "title": "Inject"
+      },
+      "methods": {
+        "description": "Allowed HTTP methods, or ['*'] for any.",
+        "items": {
+          "type": "string"
+        },
+        "title": "Methods",
+        "type": "array"
+      }
+    },
+    "required": [
+      "host"
+    ],
+    "title": "EgressRule",
+    "type": "object"
+  },
+  "EgressSecret": {
+    "properties": {
+      "header": {
+        "description": "Header name to set (e.g. 'Authorization', 'PRIVATE-TOKEN').",
+        "title": "Header",
+        "type": "string"
+      },
+      "value": {
+        "description": "Header value; redacted in logs/repr.",
+        "format": "password",
+        "title": "Value",
+        "type": "string",
+        "writeOnly": true
+      }
+    },
+    "required": [
+      "header",
+      "value"
+    ],
+    "title": "EgressSecret",
+    "type": "object"
+  },
   "FsDeleteRequest": {
     "properties": {
       "path": {
diff --git a/daiv/core/sandbox/schemas.py b/daiv/core/sandbox/schemas.py
index 505f1565a..2b50b7711 100644
--- a/daiv/core/sandbox/schemas.py
+++ b/daiv/core/sandbox/schemas.py
@@ -3,13 +3,15 @@
 from enum import StrEnum
 from typing import Literal
 
-from pydantic import Base64Bytes, BaseModel, Field, computed_field, field_validator, model_validator
+from pydantic import Base64Bytes, BaseModel, Field, SecretStr, computed_field, field_validator, model_validator
 
 
 class StartSessionRequest(BaseModel):
     base_image: str | None = Field(default=None, description="The base image to start the session with.")
     dockerfile: str | None = Field(default=None, description="The Dockerfile to use to build the base image.")
-    network_enabled: bool = Field(default=False, description="Whether to enable the network for the session.")
+    egress: EgressConfigRequest | None = Field(
+        default=None, description="Egress policy + secrets; omit to run the session network-isolated."
+    )
     memory_bytes: int | None = Field(default=None, description="Memory in bytes to be used for the session.")
     cpus: float | None = Field(default=None, description="CPUs to be used for the session.")
     environment: dict[str, str] | None = Field(
@@ -226,3 +228,116 @@ class FsDeleteResponse(BaseModel):
     @property
     def ok(self) -> bool:
         return self.error is None
+
+
+# --- Egress proxy wire schemas -----------------------------------------------
+#
+# Mirror of the daiv-sandbox ``Egress*`` schemas; kept structurally identical so the
+# schema-drift test (test_schema_consistency.py) passes. ``value`` is ``SecretStr`` for
+# log redaction — the client sends the plaintext via ``get_secret_value()``.
+
+
+def _reject_crlf(value: str, label: str) -> None:
+    """Reject CR/LF in a value that becomes an HTTP host/header on the wire (header-injection guard)."""
+    if "\r" in value or "\n" in value:
+        raise ValueError(f"{label} must not contain CR or LF")
+
+
+class EgressRule(BaseModel):
+    host: str = Field(description="Destination host glob (e.g. 'github.com', '*.githubusercontent.com').")
+    methods: list[str] = Field(default_factory=lambda: ["*"], description="Allowed HTTP methods, or ['*'] for any.")
+    inject: str | None = Field(default=None, description="Name of the secret whose header is injected for this host.")
+
+    @field_validator("methods", mode="after")
+    @classmethod
+    def _upper(cls, value: list[str]) -> list[str]:
+        if not value:
+            raise ValueError("methods must not be empty; use ['*'] to allow all methods")
+        return [m.upper() for m in value]
+
+    @field_validator("host", mode="after")
+    @classmethod
+    def _host_safe(cls, value: str) -> str:
+        # Enforced on the type, not just the form: from_stored() and apply_platform_egress() build
+        # rules outside the form, so a blank host or a CR/LF-smuggled host must be rejected here too.
+        _reject_crlf(value, "host")
+        host = value.strip()
+        if not host:
+            raise ValueError("host must not be blank")
+        return host
+
+
+class EgressSecret(BaseModel):
+    header: str = Field(description="Header name to set (e.g. 'Authorization', 'PRIVATE-TOKEN').")
+    value: SecretStr = Field(description="Header value; redacted in logs/repr.")
+
+    @field_validator("header", mode="after")
+    @classmethod
+    def _header_safe(cls, value: str) -> str:
+        # Header-injection guard at the parse boundary, covering from_stored() (drifted row) and
+        # apply_platform_egress() too — not only the form's clean_egress_json.
+        _reject_crlf(value, "header name")
+        if not value.strip():
+            raise ValueError("header name must not be blank")
+        return value
+
+    @field_validator("value", mode="after")
+    @classmethod
+    def _value_safe(cls, value: SecretStr) -> SecretStr:
+        _reject_crlf(value.get_secret_value(), "header value")
+        return value
+
+
+class EgressPolicy(BaseModel):
+    default: Literal["deny", "allow"] = Field(default="deny", description="Reachability for unlisted hosts.")
+    intercept: Literal["all", "credentialed"] = Field(
+        default="all", description="'all' MITMs every reachable host; 'credentialed' MITMs only inject hosts."
+    )
+    rules: list[EgressRule] = Field(default_factory=list)
+
+
+class EgressConfigRequest(BaseModel):
+    policy: EgressPolicy = Field(default_factory=EgressPolicy)
+    secrets: dict[str, EgressSecret] = Field(default_factory=dict)
+
+    @model_validator(mode="after")
+    def _injects_resolve(self) -> EgressConfigRequest:
+        for rule in self.policy.rules:
+            if rule.inject is not None and rule.inject not in self.secrets:
+                raise ValueError(f"rule for host {rule.host!r} references unknown secret {rule.inject!r}")
+        return self
+
+    @classmethod
+    def from_stored(cls, policy: dict, secrets: dict) -> EgressConfigRequest:
+        """Build a wire request from a stored ``egress_policy`` dict + decrypted ``egress_secrets`` dict.
+
+        Single source of truth for how persisted egress config maps onto the wire schemas (including
+        the inject-resolves invariant). Raises ``pydantic.ValidationError`` / ``TypeError`` / ``ValueError``
+        on a malformed stored shape; callers decide how to react (reject on save vs. fail-closed at runtime).
+        """
+        return cls(
+            policy=EgressPolicy.model_validate(policy), secrets={name: EgressSecret(**s) for name, s in secrets.items()}
+        )
+
+    def to_wire(self) -> dict:
+        """Serialise this request for the ``POST /session/`` ``egress`` block with **plaintext** secrets.
+
+        ``model_dump`` masks ``SecretStr`` (sending the mask would break credential injection at the
+        sidecar), so each secret value is unwrapped here via ``get_secret_value()``. This is the single
+        place that maps the typed request onto the wire shape — the client calls it instead of
+        hand-building the dict, so any new field added to ``EgressPolicy``/``EgressRule`` flows through
+        ``policy`` automatically rather than being silently dropped.
+        """
+        return {
+            "policy": self.policy.model_dump(mode="json"),
+            "secrets": {
+                name: {"header": s.header, "value": s.value.get_secret_value()} for name, s in self.secrets.items()
+            },
+        }
+
+
+class EgressConfigResponse(BaseModel):
+    ok: bool = Field(default=True, description="True when the policy was provisioned to the sidecar.")
+
+
+StartSessionRequest.model_rebuild()
diff --git a/daiv/core/utils.py b/daiv/core/utils.py
index 401d3ac4a..a81d7e384 100644
--- a/daiv/core/utils.py
+++ b/daiv/core/utils.py
@@ -25,6 +25,28 @@
 mimetypes.add_type("image/webp", ".webp")  # Add webp mimetype, not included by default
 
 
+def is_git_auth_error_text(text: str) -> bool:
+    """True when git command output indicates the remote rejected the credential (auth/permission).
+
+    Single source of truth shared by the clone-retry self-heal (``codebase.clients.gitlab``) and the
+    push-failure classifier (``automation.agent.git_manager``) so both agree on what a rejected
+    credential looks like — git's wording varies by version and by smart- vs dumb-HTTP. ``"access
+    denied"`` already subsumes GitLab's ``"HTTP Basic: Access denied"``.
+    """
+    lowered = text.lower()
+    return any(
+        marker in lowered
+        for marker in (
+            "authentication failed",
+            "access denied",
+            "returned error: 403",
+            "could not read username",
+            "permission denied",
+            "not authorized",
+        )
+    )
+
+
 def build_absolute_url(path: str) -> str:
     """Build an absolute https:// URL from a relative path using the current Site domain."""
     site = Site.objects.get_current()
diff --git a/daiv/mcp_server/server.py b/daiv/mcp_server/server.py
index 03856a744..0c410aa00 100644
--- a/daiv/mcp_server/server.py
+++ b/daiv/mcp_server/server.py
@@ -494,7 +494,7 @@ async def get_environment(
         "scope": env.scope,
         "description": env.description,
         "base_image": env.base_image,
-        "network_enabled": env.network_enabled,
+        "network_enabled": env.is_networked,
         "memory_bytes": env.memory_bytes,
         "cpus": float(env.cpus) if env.cpus is not None else None,
         "is_default": env.is_default,
diff --git a/daiv/sandbox_envs/forms.py b/daiv/sandbox_envs/forms.py
index 342148f51..79a31a46f 100644
--- a/daiv/sandbox_envs/forms.py
+++ b/daiv/sandbox_envs/forms.py
@@ -2,6 +2,8 @@
 
 import json
 import logging
+import re
+import uuid
 
 from django import forms
 from django.utils.translation import gettext_lazy as _
@@ -13,8 +15,17 @@
 MIB = 2**20
 GIB = 2**30
 _MEMORY_UNITS = {"MiB": MIB, "GiB": GIB}
-_NETWORK_TO_CHOICE = {None: "default", True: "on", False: "off"}
-_CHOICE_TO_NETWORK = {"default": None, "on": True, "off": False}
+# Valid HTTP field-name token (RFC 7230 §3.2.6). Rejects whitespace, ':' and control
+# chars so a crafted header name can't smuggle a CR/LF header-injection into the sidecar.
+_HEADER_NAME_RE = re.compile(r"^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$")
+# Placeholder shown for an unchanged secret; a submitted value equal to this (or "") means
+# "keep the stored value" on edit. The JS editor and MCP read path emit the same string.
+_MASK_SENTINEL = "******"
+
+
+def _empty_egress_state() -> dict:
+    """The egress editor's no-policy initial state (deny-all, no hosts). A fresh dict per call."""
+    return {"default": "deny", "hosts": []}
 
 
 class SandboxEnvironmentForm(forms.ModelForm):
@@ -27,11 +38,10 @@ class SandboxEnvironmentForm(forms.ModelForm):
 
     env_vars_json = forms.CharField(required=False, widget=forms.HiddenInput())
     repo_ids_json = forms.CharField(required=False, widget=forms.HiddenInput())
+    egress_json = forms.CharField(required=False, widget=forms.HiddenInput())
     memory_value = forms.IntegerField(required=False, min_value=1)
     memory_unit = forms.ChoiceField(required=False, choices=[("MiB", "MiB"), ("GiB", "GiB")], initial="MiB")
-    network_choice = forms.ChoiceField(
-        required=False, choices=[("default", _("Use default")), ("on", _("On")), ("off", _("Off"))], initial="default"
-    )
+    network_choice = forms.ChoiceField(required=False, choices=[("on", _("On")), ("off", _("Off"))], initial="off")
     memory_mode = forms.ChoiceField(
         required=False, choices=[("default", "default"), ("custom", "custom")], initial="default"
     )
@@ -60,7 +70,7 @@ def __init__(self, *args, user=None, is_admin=False, **kwargs):
             self.fields["scope"].initial = Scope.USER
         instance = self.instance
         if instance.pk is not None:
-            self.initial.setdefault("network_choice", _NETWORK_TO_CHOICE[instance.network_enabled])
+            self.initial.setdefault("network_choice", "on" if instance.is_networked else "off")
             if instance.memory_bytes:
                 if instance.memory_bytes % GIB == 0:
                     self.initial.setdefault("memory_value", instance.memory_bytes // GIB)
@@ -72,6 +82,7 @@ def __init__(self, *args, user=None, is_admin=False, **kwargs):
             self.initial.setdefault("cpu_mode", "custom" if instance.cpus else "default")
         self.fields["env_vars_json"].initial = self._initial_env_vars_json()
         self.fields["repo_ids_json"].initial = self._initial_repo_ids_json()
+        self.fields["egress_json"].initial = self._initial_egress_json()
 
     def _initial_env_vars_json(self) -> str:
         """JSON string for the env-vars editor's initial state. Secret values
@@ -107,6 +118,42 @@ def _initial_repo_ids_json(self) -> str:
             return "[]"
         return json.dumps(list(self.instance.repo_ids or []))
 
+    def _initial_egress_json(self) -> str:
+        """JSON string for the egress editor's initial state. Credential values
+        are masked (rendered as ``""`` with ``has_existing_value``) so decrypted
+        secrets never leak into page HTML. Returns the empty-policy default for
+        unsaved instances, envs with no policy, or when ciphertext can't be
+        decrypted (the POST path still blocks via
+        :meth:`_preserve_unchanged_egress_secrets`)."""
+        from core.encryption import DecryptionError
+
+        empty = json.dumps(_empty_egress_state())
+        if self.instance.pk is None or not self.instance.is_networked:
+            return empty
+        policy = self.instance.egress_policy
+        try:
+            secrets = self.instance.egress_secrets or {}
+        except DecryptionError:
+            logger.error(
+                "egress_secrets decryption failed for SandboxEnvironment id=%s; rendering empty credentials",
+                self.instance.id,
+            )
+            secrets = {}
+        hosts = []
+        for rule in policy.get("rules", []):
+            inject = rule.get("inject")
+            has_cred = bool(inject) and inject in secrets
+            hosts.append({
+                "host": rule.get("host", ""),
+                "methods": rule.get("methods") or ["*"],
+                "secret_name": inject or "",
+                # An absent/unknown inject makes the nested .get fall through to "" on its own.
+                "header": secrets.get(inject, {}).get("header", ""),
+                "value": "",
+                "has_existing_value": has_cred,
+            })
+        return json.dumps({"default": policy.get("default", "deny"), "hosts": hosts})
+
     def clean_scope(self):
         scope = self.cleaned_data["scope"]
         if scope == Scope.GLOBAL and not self.is_admin:
@@ -174,9 +221,53 @@ def clean_repo_ids_json(self):
             cleaned.append(value)
         return cleaned
 
+    def clean_egress_json(self):
+        raw = (self.cleaned_data.get("egress_json") or "").strip()
+        if not raw:
+            return _empty_egress_state()
+        try:
+            parsed = json.loads(raw)
+        except json.JSONDecodeError as err:
+            raise forms.ValidationError(_("Egress policy must be valid JSON.")) from err
+        if not isinstance(parsed, dict):
+            raise forms.ValidationError(_("Egress policy must be an object."))
+        default = parsed.get("default", "deny")
+        if default not in ("deny", "allow"):
+            raise forms.ValidationError(_("Egress default must be 'deny' or 'allow'."))
+        hosts_raw = parsed.get("hosts")
+        if not isinstance(hosts_raw, list):
+            raise forms.ValidationError(_("Egress hosts must be a list."))
+        hosts: list[dict] = []
+        for idx, entry in enumerate(hosts_raw):
+            if not isinstance(entry, dict):
+                raise forms.ValidationError(_("Egress host at index %d must be an object.") % idx)
+            host = (entry.get("host") or "").strip()
+            if not host:
+                raise forms.ValidationError(_("Egress host at index %d cannot be blank.") % idx)
+            methods = entry.get("methods")
+            if isinstance(methods, list):
+                methods = [str(m).strip().upper() for m in methods if str(m).strip()]
+            if not methods:
+                methods = ["*"]
+            header = (entry.get("header") or "").strip()
+            if header:
+                if not _HEADER_NAME_RE.match(header):
+                    raise forms.ValidationError(_("Invalid credential header name at index %d.") % idx)
+                value = entry.get("value", "")
+                if isinstance(value, str) and ("\r" in value or "\n" in value):
+                    raise forms.ValidationError(_("Credential value at index %d must not contain newlines.") % idx)
+            hosts.append({
+                "host": host,
+                "methods": methods,
+                "header": header,
+                "value": entry.get("value", ""),
+                "secret_name": (entry.get("secret_name") or "").strip(),
+                "has_existing_value": bool(entry.get("has_existing_value")),
+            })
+        return {"default": default, "hosts": hosts}
+
     def clean(self):
         cleaned = super().clean()
-        cleaned["network_enabled"] = _CHOICE_TO_NETWORK[cleaned.get("network_choice") or "default"]
         mv = cleaned.get("memory_value")
         mu = cleaned.get("memory_unit") or "MiB"
         cleaned["memory_bytes"] = mv * _MEMORY_UNITS[mu] if mv else None
@@ -184,12 +275,28 @@ def clean(self):
             self.add_error("memory_value", _("Enter a memory value or switch back to default."))
         if cleaned.get("cpu_mode") == "custom" and cleaned.get("cpus") is None:
             self.add_error("cpus", _("Enter a CPU value or switch back to default."))
+        choice = cleaned.get("network_choice") or "off"
+        if choice == "off":
+            # Off forces no network regardless of any editor state.
+            policy, secrets = None, {}
+        else:
+            egress_parsed = cleaned.get("egress_json") or _empty_egress_state()
+            policy, secrets = self._build_egress(egress_parsed)
+            if policy is None:
+                # On must permit something: at least one allowed host, or default=allow.
+                self.add_error(
+                    "network_choice",
+                    _(
+                        "Network is On but the egress policy permits nothing. Add at least one allowed host, "
+                        "set the default to allow, or switch Network to Off."
+                    ),
+                )
+        cleaned["egress_policy"], cleaned["egress_secrets"] = policy, secrets
         return cleaned
 
     def save(self, commit: bool = True) -> SandboxEnvironment:
         env_vars = self.cleaned_data.get("env_vars_json") or []
         instance: SandboxEnvironment = super().save(commit=False)
-        instance.network_enabled = self.cleaned_data.get("network_enabled")
         instance.memory_bytes = self.cleaned_data.get("memory_bytes")
         instance.repo_ids = self.cleaned_data.get("repo_ids_json") or []
         if instance.scope == Scope.USER and self.user is not None:
@@ -197,11 +304,72 @@ def save(self, commit: bool = True) -> SandboxEnvironment:
         if instance.pk is not None:
             env_vars = self._preserve_unchanged_secrets(instance, env_vars)
         instance.env_vars = env_vars
+        egress_secrets = self.cleaned_data.get("egress_secrets") or {}
+        if instance.pk is not None:
+            egress_secrets = self._preserve_unchanged_egress_secrets(instance, egress_secrets)
+        instance.egress_policy = self.cleaned_data.get("egress_policy")
+        instance.egress_secrets = egress_secrets
         if commit:
             instance.full_clean()
             instance.save()
         return instance
 
+    @staticmethod
+    def _build_egress(parsed: dict) -> tuple[dict | None, dict]:
+        """Translate the normalised egress editor state into the stored
+        ``(egress_policy, egress_secrets)`` shapes. A host with a credential
+        synthesises a named secret (``inject``); hosts without one get
+        ``inject=None``.
+
+        Returns ``(None, {})`` only when there are no rules **and** the default
+        is ``deny`` (a deny-all with no allowed hosts stores no policy rather than
+        an explicit deny-all, so re-saving an env without touching egress does not
+        change its runtime behaviour). An allow-default with no rules *does* store
+        a policy (allow-all). To block all outbound traffic, set **Network** to
+        Off instead."""
+        rules: list[dict] = []
+        secrets: dict[str, dict] = {}
+        for host in parsed["hosts"]:
+            inject = None
+            if host["header"]:
+                name = host["secret_name"] or f"s_{uuid.uuid4().hex}"
+                secrets[name] = {"header": host["header"], "value": host["value"]}
+                inject = name
+            rules.append({"host": host["host"], "methods": host["methods"], "inject": inject})
+        if not rules and parsed["default"] != "allow":
+            return None, {}
+        # TLS inspection is not user-configurable: the proxy always intercepts every reachable
+        # host so per-host credentials and method rules are enforceable. Always store "all".
+        policy = {"default": parsed["default"], "intercept": "all", "rules": rules}
+        return policy, secrets
+
+    @staticmethod
+    def _preserve_unchanged_egress_secrets(instance: SandboxEnvironment, submitted: dict) -> dict:
+        """Restore the stored value for any submitted egress secret whose value is
+        the masked sentinel (``""`` or ``"******"``), matched by synthesised
+        ``secret_name`` against the instance's persisted ``egress_secrets``.
+
+        Raises a form-level :class:`ValidationError` if existing ciphertext cannot
+        be decrypted — proceeding would persist the mask and destroy the secret."""
+        from core.encryption import DecryptionError
+
+        try:
+            existing = instance.egress_secrets or {}
+        except DecryptionError as err:
+            raise forms.ValidationError(
+                _(
+                    "Existing egress secrets could not be decrypted. Re-enter all credential values "
+                    "before saving, or restore DAIV_ENCRYPTION_KEY."
+                )
+            ) from err
+        out: dict[str, dict] = {}
+        for name, sec in submitted.items():
+            if sec.get("value", "") in ("", _MASK_SENTINEL) and name in existing:
+                out[name] = {**sec, "value": existing[name].get("value", "")}
+            else:
+                out[name] = sec
+        return out
+
     @staticmethod
     def _preserve_unchanged_secrets(instance: SandboxEnvironment, submitted_rows: list[dict]) -> list[dict]:
         """Restore the stored value for any submitted secret row whose value is
@@ -227,7 +395,7 @@ def _preserve_unchanged_secrets(instance: SandboxEnvironment, submitted_rows: li
         out: list[dict] = []
         for row in submitted_rows:
             name = row.get("name")
-            if row.get("is_secret") and row.get("value") in ("", "******") and name in existing:
+            if row.get("is_secret") and row.get("value") in ("", _MASK_SENTINEL) and name in existing:
                 row = {**row, "value": existing[name]}
             out.append(row)
         return out
diff --git a/daiv/sandbox_envs/migrations/0005_sandboxenvironment__egress_secrets_encrypted_and_more.py b/daiv/sandbox_envs/migrations/0005_sandboxenvironment__egress_secrets_encrypted_and_more.py
new file mode 100644
index 000000000..c194201b3
--- /dev/null
+++ b/daiv/sandbox_envs/migrations/0005_sandboxenvironment__egress_secrets_encrypted_and_more.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-06-23 16:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [("sandbox_envs", "0004_repo_ids")]
+
+    operations = [
+        migrations.AddField(
+            model_name="sandboxenvironment",
+            name="_egress_secrets_encrypted",
+            field=models.TextField(blank=True, editable=False, null=True),
+        ),
+        migrations.AddField(
+            model_name="sandboxenvironment",
+            name="egress_policy",
+            field=models.JSONField(blank=True, default=None, null=True, verbose_name="egress policy"),
+        ),
+    ]
diff --git a/daiv/sandbox_envs/migrations/0006_drop_network_enabled.py b/daiv/sandbox_envs/migrations/0006_drop_network_enabled.py
new file mode 100644
index 000000000..5c1283e1f
--- /dev/null
+++ b/daiv/sandbox_envs/migrations/0006_drop_network_enabled.py
@@ -0,0 +1,25 @@
+from django.db import migrations
+
+
+def null_egress_for_off_envs(apps, schema_editor):
+    """Preserve 'off' intent before the column is dropped: an env that was network-off (or unset) but
+    happens to carry a stored egress policy must not silently flip to networked. Null its policy.
+
+    Runs BEFORE RemoveField, so the historical model still exposes ``network_enabled``."""
+    SandboxEnvironment = apps.get_model("sandbox_envs", "SandboxEnvironment")
+    SandboxEnvironment.objects.exclude(network_enabled=True).filter(egress_policy__isnull=False).update(
+        egress_policy=None, _egress_secrets_encrypted=None
+    )
+
+
+def noop_reverse(apps, schema_editor):
+    # No reverse: the network_enabled distinction is gone and cannot be reconstructed.
+    pass
+
+
+class Migration(migrations.Migration):
+    dependencies = [("sandbox_envs", "0005_sandboxenvironment__egress_secrets_encrypted_and_more")]
+    operations = [
+        migrations.RunPython(null_egress_for_off_envs, noop_reverse),
+        migrations.RemoveField(model_name="sandboxenvironment", name="network_enabled"),
+    ]
diff --git a/daiv/sandbox_envs/models.py b/daiv/sandbox_envs/models.py
index a9d282e7f..c6e4462b1 100644
--- a/daiv/sandbox_envs/models.py
+++ b/daiv/sandbox_envs/models.py
@@ -20,6 +20,9 @@
 _REPO_ID_RE = re.compile(r"^[^\s/]+(/[^\s/]+)+$")
 ENV_VARS_MAX_ENTRIES = 100
 ENV_VARS_MAX_ENCRYPTED_SIZE = 32 * 1024  # 32 KiB
+EGRESS_MAX_RULES = 100
+EGRESS_MAX_SECRETS = 100
+EGRESS_SECRETS_MAX_ENCRYPTED_SIZE = 32 * 1024  # 32 KiB
 
 _UNSET = object()
 
@@ -90,7 +93,6 @@ class SandboxEnvironment(TimeStampedModel):
     description = models.TextField(_("description"), blank=True, default="")
 
     base_image = models.CharField(_("base image"), max_length=255, blank=True, default="")
-    network_enabled = models.BooleanField(_("network enabled"), null=True, blank=True, default=None)
     memory_bytes = models.PositiveBigIntegerField(_("memory (bytes)"), null=True, blank=True)
     cpus = models.DecimalField(_("CPUs"), max_digits=5, decimal_places=2, null=True, blank=True)
 
@@ -101,6 +103,24 @@ class SandboxEnvironment(TimeStampedModel):
 
     is_default = models.BooleanField(_("is default"), default=False)
 
+    # Per-env egress policy provisioned to the daiv-sandbox sidecar proxy.
+    # A non-null value means this env is networked: the session is routed through the egress proxy
+    # and the policy controls which outbound hosts are permitted.
+    # ``None`` means the env grants no general network access. The egress proxy is mandatory for any
+    # outbound traffic: a networked env on a sandbox with no egress proxy configured (no shared egress
+    # CA) is rejected at session start — there is no raw-network fallback.
+    # DAIV additionally injects a runtime-only, never-stored allow-rule for the run's git platform so the
+    # repo's platform is reachable for git-over-HTTPS — credentialed whenever a token can be minted. Because
+    # DAIV pushes from inside the sandbox, this rule is injected even when ``egress`` is ``None`` *if* the run
+    # holds a real push token: such a network-off env is opened into a minimal deny-all base carrying only
+    # the git-platform rule (everything else stays blocked), so DAIV can always publish. A token-less run
+    # (e.g. the SWE eval platform) leaves a ``None`` env fully network-isolated. The reserved secret name
+    # ``__daiv_git_platform__`` (``_validate_egress`` rejects an env that uses it) backs the rule; it is
+    # prepended so it wins by first-match over a same-host user rule, and is not shown in the UI.
+    egress_policy = models.JSONField(_("egress policy"), null=True, blank=True, default=None)
+    _egress_secrets_encrypted = models.TextField(blank=True, null=True, editable=False)  # noqa: DJ001 — NULL = no secrets
+    egress_secrets = EncryptedJSONFieldDescriptor("egress_secrets")
+
     objects = SandboxEnvironmentQuerySet.as_manager()
 
     class Meta:
@@ -128,15 +148,26 @@ class Meta:
         ]
 
     def __init__(self, *args, **kwargs) -> None:
-        # Route ``env_vars`` through the descriptor so ``Manager.create(env_vars=...)`` works.
+        # Route ``env_vars``/``egress_secrets`` through their descriptors so ``Manager.create(...)`` works.
         env_vars_value = kwargs.pop("env_vars", _UNSET)
+        egress_secrets_value = kwargs.pop("egress_secrets", _UNSET)
         super().__init__(*args, **kwargs)
         if env_vars_value is not _UNSET:
             self.env_vars = env_vars_value
+        if egress_secrets_value is not _UNSET:
+            self.egress_secrets = egress_secrets_value
 
     def __str__(self) -> str:
         return f"{self.get_scope_display()}: {self.name}"
 
+    @property
+    def is_networked(self) -> bool:
+        """True iff this env grants network access. Network is derived solely from the presence of an
+        egress policy (there is no separate flag): a non-null ``egress_policy`` routes the session
+        through the egress proxy, ``None`` runs it network-isolated. Single source of truth for the
+        derivation used by ``summary``, the form, the services layer, and the MCP server."""
+        return self.egress_policy is not None
+
     @property
     def summary(self) -> str:
         """Compact one-line description of this env's runtime shape.
@@ -144,7 +175,7 @@ def summary(self) -> str:
         Format: ``"<base_image> · <N> CPU · <memory> · net"`` with each
         segment omitted when its source value is missing. Memory renders
         as ``GiB`` for whole-GiB values, ``MiB`` otherwise. Network is
-        included only when explicitly enabled (True)."""
+        included only when an egress policy is configured."""
         parts: list[str] = []
         if self.base_image:
             parts.append(self.base_image)
@@ -152,19 +183,19 @@ def summary(self) -> str:
             parts.append(f"{_fmt_cpus(self.cpus)} CPU")
         if self.memory_bytes is not None:
             parts.append(_fmt_memory(self.memory_bytes))
-        if self.network_enabled is True:
+        if self.is_networked:
             parts.append("net")
         return " · ".join(parts)
 
     @property
     def short_summary(self) -> str:
         """Compact ``"<base_image>"`` description, with ``" · net"`` appended
-        when network access is explicitly enabled. Segments are omitted when
-        their source value is missing."""
+        when an egress policy is configured. Segments are omitted when their
+        source value is missing."""
         parts: list[str] = []
         if self.base_image:
             parts.append(self.base_image)
-        if self.network_enabled is True:
+        if self.is_networked:
             parts.append("net")
         return " · ".join(parts)
 
@@ -196,6 +227,7 @@ def clean(self) -> None:
         self.base_image = self.base_image.strip()
         self._validate_env_vars()
         self._validate_repo_ids()
+        self._validate_egress()
 
     def _validate_env_vars(self) -> None:
         from core.encryption import DecryptionError
@@ -271,6 +303,56 @@ def _validate_repo_ids(self) -> None:
                     % {"repos": ", ".join(overlap), "name": other.name}
                 })
 
+    def _validate_egress(self) -> None:
+        from pydantic import ValidationError as PydanticValidationError
+
+        from core.encryption import DecryptionError
+        from core.sandbox.schemas import EgressConfigRequest
+
+        if self.egress_policy is None:
+            return  # no egress configured
+        if not isinstance(self.egress_policy, dict):
+            raise ValidationError({"egress_policy": _("Egress policy must be an object.")})
+
+        raw = self._egress_secrets_encrypted or ""
+        if len(raw) > EGRESS_SECRETS_MAX_ENCRYPTED_SIZE:
+            raise ValidationError({"egress_secrets": _("Egress secrets exceed 32 KiB encrypted.")})
+        try:
+            secrets_raw = self.egress_secrets or {}
+        except DecryptionError as err:
+            raise ValidationError({
+                NON_FIELD_ERRORS: _(
+                    "Existing egress secrets could not be decrypted. Re-enter all secret values, "
+                    "or restore DAIV_ENCRYPTION_KEY."
+                )
+            }) from err
+        if not isinstance(secrets_raw, dict):
+            raise ValidationError({"egress_secrets": _("Egress secrets must be an object.")})
+        if len(self.egress_policy.get("rules") or []) > EGRESS_MAX_RULES:
+            raise ValidationError({"egress_policy": _("Too many egress rules (max %d).") % EGRESS_MAX_RULES})
+        if len(secrets_raw) > EGRESS_MAX_SECRETS:
+            raise ValidationError({"egress_secrets": _("Too many egress secrets (max %d).") % EGRESS_MAX_SECRETS})
+
+        # Authoritative shape + inject-resolves check (count/size caps handled above): build the wire request.
+        try:
+            request = EgressConfigRequest.from_stored(self.egress_policy, secrets_raw)
+        except (PydanticValidationError, TypeError, ValueError) as err:
+            raise ValidationError({"egress_policy": _("Invalid egress configuration: %s") % err}) from err
+
+        # The git-platform secret name is reserved: apply_platform_egress overwrites that key (and
+        # prepends a rule injecting it) at runtime, so a stored secret/inject of the same name would be
+        # silently displaced. Reject it at save time. Checked on the validated request so the rule/secret
+        # shape stays owned by from_stored rather than re-walked here.
+        from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME
+
+        if PLATFORM_EGRESS_SECRET_NAME in request.secrets or any(
+            rule.inject == PLATFORM_EGRESS_SECRET_NAME for rule in request.policy.rules
+        ):
+            raise ValidationError({
+                "egress_secrets": _("The egress secret name '%s' is reserved for DAIV's git-platform credential.")
+                % PLATFORM_EGRESS_SECRET_NAME
+            })
+
     def promote_as_default(self) -> None:
         """Atomically demote any other GLOBAL default and mark this env as default.
 
diff --git a/daiv/sandbox_envs/services.py b/daiv/sandbox_envs/services.py
index 832fde219..583d4184f 100644
--- a/daiv/sandbox_envs/services.py
+++ b/daiv/sandbox_envs/services.py
@@ -13,10 +13,16 @@
 if TYPE_CHECKING:
     from activity.services import RepoTarget
 
+    from codebase.base import Repository
+    from codebase.clients import RepoClient
+    from codebase.clients.base import GitEgressCredential
     from codebase.context import SandboxRuntime
+    from core.sandbox.schemas import EgressConfigRequest
 
 logger = logging.getLogger("daiv.sandbox_envs")
 
+PLATFORM_EGRESS_SECRET_NAME = "__daiv_git_platform__"  # noqa: S105
+
 
 @dataclass(frozen=True)
 class SandboxEnvOverride:
@@ -25,14 +31,17 @@ class SandboxEnvOverride:
     and :func:`merge_sandbox_runtime` / :func:`set_runtime_ctx`."""
 
     base_image: str | None
-    network_enabled: bool | None
     memory_bytes: int | None
     cpus: float | None
     env_vars: dict[str, str]
+    egress: EgressConfigRequest | None = None
 
 
 def row_to_override(env: SandboxEnvironment) -> SandboxEnvOverride:
+    from pydantic import ValidationError as PydanticValidationError
+
     from core.encryption import DecryptionError
+    from core.sandbox.schemas import EgressConfigRequest
 
     try:
         env_vars_rows = env.env_vars or []
@@ -41,9 +50,27 @@ def row_to_override(env: SandboxEnvironment) -> SandboxEnvOverride:
         # keep going. The descriptor already logs at exception level.
         logger.error("env_vars decryption failed for SandboxEnvironment id=%s; dropping env_vars", env.id)
         env_vars_rows = []
+
+    egress = None
+    if env.is_networked:
+        try:
+            egress = EgressConfigRequest.from_stored(env.egress_policy, env.egress_secrets or {})
+        except DecryptionError, PydanticValidationError, TypeError, ValueError:
+            # The env intended restricted egress but its config is unusable (e.g. a rotated
+            # DAIV_ENCRYPTION_KEY left the secrets undecryptable, or the row was hand-edited).
+            # Fail closed to NO network (egress=None → network_mode=none) — the old deny-all-with-plumbing
+            # state no longer exists and would be rejected by the sandbox. Never reach the sidecar with a
+            # half/invalid config. logger.exception (not error) so the shape errors — which, unlike
+            # DecryptionError, nothing else logs — don't vanish into this branch untraced.
+            logger.exception(
+                "egress config unusable for SandboxEnvironment id=%s (%s); failing closed to no-network",
+                env.id,
+                env.name,
+            )
+            egress = None
+
     return SandboxEnvOverride(
         base_image=env.base_image or None,
-        network_enabled=env.network_enabled,
         memory_bytes=env.memory_bytes,
         cpus=float(env.cpus) if isinstance(env.cpus, Decimal) else env.cpus,
         env_vars={
@@ -51,9 +78,63 @@ def row_to_override(env: SandboxEnvironment) -> SandboxEnvOverride:
             for entry in env_vars_rows
             if entry.get("name") and entry.get("value") is not None
         },
+        egress=egress,
     )
 
 
+def apply_platform_egress(
+    egress: EgressConfigRequest | None, credential: GitEgressCredential | None
+) -> EgressConfigRequest | None:
+    """Prepend the DAIV-managed git-platform allow-rule (and add its credential) to ``egress``.
+
+    Runtime-only — the result is provisioned to the sidecar but never stored on the environment.
+    The rule is **prepended** so it wins under the sidecar's first-match (always reachable;
+    credentialed when the credential carries a token). ``credential is None`` → ``egress`` unchanged.
+    With no base policy, the base is a
+    deny-all (``default="deny"``, ``intercept="all"``); an existing policy's ``default``/``intercept``
+    and rules are preserved. The secret is added (overwriting any same-named user key) only when the
+    credential carries a token; otherwise the rule is reachability-only (``inject=None``)."""
+    from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+    if credential is None:
+        return egress
+
+    base_policy = egress.policy if egress is not None else EgressPolicy()
+    secrets = dict(egress.secrets) if egress is not None else {}
+
+    inject = None
+    if credential.value is not None:
+        inject = PLATFORM_EGRESS_SECRET_NAME
+        secrets[PLATFORM_EGRESS_SECRET_NAME] = EgressSecret(header=credential.header, value=credential.value)
+
+    platform_rule = EgressRule(host=credential.host, methods=["*"], inject=inject)
+    policy = base_policy.model_copy(update={"rules": [platform_rule, *base_policy.rules]})
+    return EgressConfigRequest(policy=policy, secrets=secrets)
+
+
+def augment_sandbox_with_platform_egress(
+    sandbox: SandboxRuntime, repo_client: RepoClient, repository: Repository
+) -> SandboxRuntime:
+    """Layer the git-platform allow-rule + credential onto ``sandbox.egress``. Returns a new
+    ``SandboxRuntime`` (frozen); the platform contribution is resolved per run via ``repo_client`` and
+    never stored.
+
+    A network-on env (``egress`` already set) always has the rule layered on top of its policy. A
+    network-off env (``egress is None``) is normally fully isolated — but DAIV runs git, *including the
+    publish push/ls-remote against ``origin``*, from inside the sandbox. So when the run holds a real
+    push credential (a token), a network-off env is still opened into a minimal deny-all base carrying
+    only the git-platform rule, so DAIV can always reach the repo to publish. A host-only credential
+    (no token, e.g. the SWE eval platform) leaves a network-off env isolated: there is nothing to push,
+    and opening a triad would needlessly force the egress proxy onto token-less / eval runs and break
+    their hermeticity. No-op when the sandbox is disabled."""
+    if not sandbox.enabled:
+        return sandbox
+    credential = repo_client.get_git_egress_credential(repository)
+    if sandbox.egress is None and (credential is None or credential.value is None):
+        return sandbox
+    return replace(sandbox, egress=apply_platform_egress(sandbox.egress, credential))
+
+
 async def resolve_sandbox_env(env_id: str | None) -> SandboxEnvOverride | None:
     """Load the explicit per-run env.
 
@@ -83,15 +164,16 @@ async def get_global_default() -> SandboxEnvOverride | None:
 
 
 def humanise_global_default() -> dict[str, str | bool]:
-    """Synchronous, template-friendly view of the GLOBAL default's row values."""
+    """Synchronous, template-friendly view of the GLOBAL default's row values.
+
+    Network is intentionally omitted: the form's Network control is a self-contained On/Off that
+    neither displays nor inherits the global default, so only memory/cpus are surfaced here."""
     row = SandboxEnvironment.objects.filter(scope=Scope.GLOBAL, is_default=True).first()
     if row is None:
-        return {"network": "", "memory": "", "cpus": "", "has_network": False, "has_memory": False, "has_cpus": False}
+        return {"memory": "", "cpus": "", "has_memory": False, "has_cpus": False}
     return {
-        "network": "enabled" if row.network_enabled is True else ("disabled" if row.network_enabled is False else ""),
         "memory": _fmt_memory(row.memory_bytes) if row.memory_bytes is not None else "",
         "cpus": _fmt_cpus(row.cpus) if row.cpus is not None else "",
-        "has_network": row.network_enabled is not None,
         "has_memory": row.memory_bytes is not None,
         "has_cpus": row.cpus is not None,
     }
@@ -206,11 +288,12 @@ def merge_sandbox_runtime(
 ) -> SandboxRuntime:
     """Resolve the effective sandbox runtime from a per-run env + GLOBAL default.
 
-    For each resource field (``base_image``, ``network_enabled``, ``memory_bytes``,
-    ``cpus``): the per-run env wins when its value is non-None; otherwise the
-    GLOBAL default wins; otherwise the field's runtime default applies.
+    For each resource field (``base_image``, ``memory_bytes``, ``cpus``): the
+    per-run env wins when its value is non-None; otherwise the GLOBAL default
+    wins; otherwise the field's runtime default applies.
 
     ``env_vars`` are unioned with per-run keys shadowing GLOBAL keys.
+    ``egress`` is taken from the effective env as-is (see inline comment).
     ``command_policy`` defaults to an empty policy; built-in safety rules in
     :mod:`core.sandbox.command_policy` still apply.
     """
@@ -230,9 +313,13 @@ def pick(field: str, runtime_default):
 
     return SandboxRuntime(
         base_image=pick("base_image", None),
-        network_enabled=pick("network_enabled", False),
         memory_bytes=pick("memory_bytes", None),
         cpus=pick("cpus", None),
+        # Network is explicit per env (no inherit): take the effective env's egress as-is. A per-run env
+        # that is Off (egress=None) must NOT inherit the global default's policy, so this is not pick().
+        egress=(
+            per_run.egress if per_run is not None else (global_default.egress if global_default is not None else None)
+        ),
         env_vars={**(global_default.env_vars if global_default else {}), **(per_run.env_vars if per_run else {})},
         command_policy=SandboxCommandPolicy(),
     )
diff --git a/daiv/sandbox_envs/static/sandbox_envs/js/egress-editor.js b/daiv/sandbox_envs/static/sandbox_envs/js/egress-editor.js
new file mode 100644
index 000000000..c8851d280
--- /dev/null
+++ b/daiv/sandbox_envs/static/sandbox_envs/js/egress-editor.js
@@ -0,0 +1,111 @@
+/**
+ * Alpine component: egress policy editor for the sandbox environment form.
+ *
+ * Rules-first with inline credentials. Each host row may attach a credential
+ * (header + masked value); the named secret the backend stores is synthesised
+ * here as a stable `secret_name` (minted once when the credential is enabled)
+ * and round-tripped so unchanged secrets are preserved on save.
+ *
+ * Constructor arg: {default, hosts: [...]} — the masked initial
+ * state produced by SandboxEnvironmentForm._initial_egress_json().
+ */
+function mintSecretName() {
+    const rand = (window.crypto && crypto.randomUUID)
+        ? crypto.randomUUID()
+        : Math.random().toString(36).slice(2);
+    return "s_" + rand.replace(/-/g, "");
+}
+
+const READ_ONLY_METHODS = ["GET", "HEAD", "OPTIONS"];
+
+/** True iff `methods` is exactly the read-only set (case/order-insensitive). */
+function isReadOnlyMethods(methods) {
+    if (!Array.isArray(methods)) return false;
+    const set = new Set(methods.map((m) => String(m).trim().toUpperCase()).filter(Boolean));
+    return set.size === READ_ONLY_METHODS.length && READ_ONLY_METHODS.every((m) => set.has(m));
+}
+
+function egressEditorState(initial = {}, labels = {}) {
+    const hosts = Array.isArray(initial.hosts) ? initial.hosts : [];
+    return {
+        defaultPolicy: initial.default === "allow" ? "allow" : "deny",
+        labels: {
+            duplicateHost: labels.duplicateHost || "Duplicate host",
+        },
+        hosts: hosts.map((h) => {
+            const methods = Array.isArray(h.methods) && h.methods.length ? h.methods : ["*"];
+            return {
+                host: h.host || "",
+                methodsMode: isReadOnlyMethods(methods) ? "readonly" : "all",
+                showCredential: !!(h.header || h.has_existing_value),
+                header: h.header || "",
+                value: h.value || "",
+                secret_name: h.secret_name || "",
+                has_existing_value: !!h.has_existing_value,
+            };
+        }),
+
+        addHost() {
+            this.hosts.push({
+                host: "", methodsMode: "all",
+                showCredential: false, header: "", value: "",
+                secret_name: "", has_existing_value: false,
+            });
+        },
+
+        removeHost(i) { this.hosts.splice(i, 1); },
+
+        toggleCredential(i) {
+            const h = this.hosts[i];
+            h.showCredential = !h.showCredential;
+            if (h.showCredential) {
+                if (!h.secret_name) h.secret_name = mintSecretName();
+            } else {
+                h.header = "";
+                h.value = "";
+                h.secret_name = "";
+                h.has_existing_value = false;
+            }
+        },
+
+        hostError(i) {
+            const h = this.hosts[i];
+            if (!h) return "";
+            const host = (h.host || "").trim();
+            if (!host) return "";  // blank rows are dropped, not flagged
+            for (let j = 0; j < i; j++) {
+                if ((this.hosts[j].host || "").trim() === host) return this.labels.duplicateHost;
+            }
+            return "";
+        },
+
+        _methodsFor(h) {
+            return h.methodsMode === "readonly" ? [...READ_ONLY_METHODS] : ["*"];
+        },
+
+        get serialised() {
+            return {
+                default: this.defaultPolicy,
+                hosts: this.hosts
+                    .filter((h) => (h.host || "").trim())
+                    .map((h) => {
+                        const hasCred = h.showCredential && (h.header || "").trim();
+                        return {
+                            host: (h.host || "").trim(),
+                            methods: this._methodsFor(h),
+                            header: hasCred ? (h.header || "").trim() : "",
+                            value: hasCred ? (h.value || "") : "",
+                            secret_name: hasCred ? h.secret_name : "",
+                            has_existing_value: !!h.has_existing_value,
+                        };
+                    }),
+            };
+        },
+    };
+}
+
+document.addEventListener("alpine:init", () => {
+    Alpine.data("egressEditor", egressEditorState);
+});
+
+window.egressEditorState = egressEditorState;
diff --git a/daiv/sandbox_envs/static/sandbox_envs/js/resource-control.js b/daiv/sandbox_envs/static/sandbox_envs/js/resource-control.js
index c828d8cca..c8aa29ae2 100644
--- a/daiv/sandbox_envs/static/sandbox_envs/js/resource-control.js
+++ b/daiv/sandbox_envs/static/sandbox_envs/js/resource-control.js
@@ -2,32 +2,31 @@
  * Alpine component for the Resources section of the sandbox env form.
  *
  * Owns:
- *   - `network` ('default'|'on'|'off')
  *   - `memMode` ('default'|'custom'), `memValue` (string), `memUnit` ('MiB'|'GiB')
  *   - `cpuMode` ('default'|'custom'), `cpuValue` (string)
  *
  * `resourcesOpen` is the collapsible's open state. Initialised true if any
  * resource field is overridden, has an error, or the parent template forces
  * it (GLOBAL-default form).
+ *
+ * Network is no longer owned here — it is managed by the top-level network
+ * scope in the template.
  */
 const MIB = 1024 * 1024;
 const GIB = 1024 * 1024 * 1024;
 
 document.addEventListener("alpine:init", () => {
     Alpine.data("resourceControl", (initial = {}) => ({
-        network: initial.network || "default",
         memMode: initial.memValue ? "custom" : "default",
         memValue: initial.memValue || "",
         memUnit: initial.memUnit || "MiB",
         cpuMode: initial.cpuValue ? "custom" : "default",
         cpuValue: initial.cpuValue || "",
         resourcesOpen: !!initial.forceOpen
-                       || initial.network !== "default"
                        || !!initial.memValue
                        || !!initial.cpuValue
                        || !!initial.hasErrors,
 
-        setNetwork(value) { this.network = value; },
         setMemMode(value) {
             this.memMode = value;
             if (value === "default") { this.memValue = ""; }
@@ -37,14 +36,8 @@ document.addEventListener("alpine:init", () => {
             if (value === "default") { this.cpuValue = ""; }
         },
 
-        get memHiddenValue() {
-            return this.memMode === "custom" ? this.memValue : "";
-        },
-        get memHiddenUnit() {
-            return this.memMode === "custom" ? this.memUnit : "MiB";
-        },
-        get cpuHiddenValue() {
-            return this.cpuMode === "custom" ? this.cpuValue : "";
-        },
+        get memHiddenValue() { return this.memMode === "custom" ? this.memValue : ""; },
+        get memHiddenUnit() { return this.memMode === "custom" ? this.memUnit : "MiB"; },
+        get cpuHiddenValue() { return this.cpuMode === "custom" ? this.cpuValue : ""; },
     }));
 });
diff --git a/daiv/sandbox_envs/templates/sandbox_envs/_form_body.html b/daiv/sandbox_envs/templates/sandbox_envs/_form_body.html
index e8f30abad..21050c0a6 100644
--- a/daiv/sandbox_envs/templates/sandbox_envs/_form_body.html
+++ b/daiv/sandbox_envs/templates/sandbox_envs/_form_body.html
@@ -156,13 +156,117 @@
 
     <div class="border-t border-white/[0.06]"></div>
 
+    <div x-data="{
+             network: '{{ form.network_choice.value|default:'off'|escapejs }}',
+             get effectiveNetworkOn() { return this.network === 'on'; },
+         }">
+        {# Network (promoted to top-level) #}
+        <div>
+            <label class="block text-[15px] font-medium text-gray-400">
+                {% translate "Network" %}
+                {% if form.network_choice.field.disabled %}{% include "core/_env_lock_badge.html" %}{% endif %}
+            </label>
+            <div class="mt-2 flex flex-wrap items-center gap-1 rounded-xl border border-white/[0.06] bg-white/[0.02] p-1">
+                <label class="cursor-pointer rounded-lg px-3 py-1.5 text-sm font-medium transition-all duration-200"
+                       :class="network === 'on' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'"
+                       {% if form.network_choice.field.disabled %}aria-disabled="true" style="pointer-events:none;opacity:0.6;"{% endif %}>
+                    <input type="radio" name="network_choice" value="on" x-model="network" class="sr-only"
+                           {% if form.network_choice.field.disabled %}disabled{% endif %}>
+                    {% translate "On" %}
+                </label>
+                <label class="cursor-pointer rounded-lg px-3 py-1.5 text-sm font-medium transition-all duration-200"
+                       :class="network === 'off' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'"
+                       {% if form.network_choice.field.disabled %}aria-disabled="true" style="pointer-events:none;opacity:0.6;"{% endif %}>
+                    <input type="radio" name="network_choice" value="off" x-model="network" class="sr-only"
+                           {% if form.network_choice.field.disabled %}disabled{% endif %}>
+                    {% translate "Off" %}
+                </label>
+            </div>
+            {% if form.network_choice.errors %}<p class="mt-1.5 text-sm text-red-400">{{ form.network_choice.errors.0 }}</p>{% endif %}
+        </div>
+
+        {# Network access (egress) — only meaningful when network is on #}
+        <fieldset x-show="effectiveNetworkOn" x-cloak class="mt-5"
+                  x-data="egressEditor({{ form.egress_json.value|default:form.egress_json.initial }}, {
+                      duplicateHost: '{% translate 'Duplicate host'|escapejs %}',
+                  })">
+            <legend class="text-[15px] font-medium text-gray-300">{% translate "Network access" %}</legend>
+            <p class="mt-1 text-sm text-gray-400">
+                {% translate "Restricts which hosts the sandbox can reach. With Default set to deny, only the listed hosts are reachable — plus this environment's own git platform, which DAIV always allows for git operations. Leave the list empty to apply no egress policy; to block all outbound access, set Network to off." %}
+            </p>
+
+            <div class="mt-3 flex flex-wrap gap-6">
+                <div>
+                    <span class="block text-sm font-medium text-gray-400">{% translate "Unlisted hosts" %}</span>
+                    <div class="mt-1.5 flex items-center gap-1 rounded-xl border border-white/[0.06] bg-white/[0.02] p-1">
+                        <label class="cursor-pointer rounded-lg px-3 py-1 text-sm font-medium"
+                               :class="defaultPolicy === 'deny' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'">
+                            <input type="radio" value="deny" x-model="defaultPolicy" class="sr-only">{% translate "Deny" %}
+                        </label>
+                        <label class="cursor-pointer rounded-lg px-3 py-1 text-sm font-medium"
+                               :class="defaultPolicy === 'allow' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'">
+                            <input type="radio" value="allow" x-model="defaultPolicy" class="sr-only">{% translate "Allow" %}
+                        </label>
+                    </div>
+                    <p x-show="defaultPolicy === 'allow'" x-cloak class="mt-1 text-xs text-amber-400/80">
+                        {% translate "All hosts reachable unless a rule restricts them." %}
+                    </p>
+                </div>
+            </div>
+
+            <div class="mt-4">
+                <span class="text-[15px] font-medium text-gray-300">
+                    {% translate "Allowed hosts" %}
+                    <span class="text-gray-500" x-text="hosts.length ? '(' + hosts.length + ')' : ''"></span>
+                </span>
+
+                <template x-for="(h, i) in hosts" :key="i">
+                    <div class="mt-2 rounded-lg border border-white/[0.06] bg-white/[0.02] p-2">
+                        <div class="flex items-center gap-2">
+                            <input type="text" x-model="h.host" placeholder="github.com" class="flex-1 font-mono"
+                                   :class="hostError(i) ? '!border-red-500/60 focus:!ring-red-500/30' : ''">
+                            <select x-model="h.methodsMode" class="!w-32">
+                                <option value="all">{% translate "All methods" %}</option>
+                                <option value="readonly">{% translate "Read-only" %}</option>
+                            </select>
+                            <button type="button" @click="toggleCredential(i)" class="btn-secondary text-sm whitespace-nowrap"
+                                    x-text="h.showCredential ? '{% translate '– credential'|escapejs %}' : '{% translate '+ credential'|escapejs %}'"></button>
+                            <button type="button" @click="removeHost(i)" aria-label="{% translate 'Remove' %}"
+                                    class="inline-flex h-8 w-8 items-center justify-center rounded-md text-gray-500 hover:bg-white/[0.06] hover:text-red-300">
+                                {% icon "trash" "h-4 w-4" %}
+                            </button>
+                        </div>
+                        <p x-show="h.methodsMode === 'readonly'" x-cloak
+                           class="mt-2 font-mono text-xs text-gray-500">GET, HEAD, OPTIONS</p>
+                        <div x-show="h.showCredential" x-cloak class="mt-2 flex items-center gap-2">
+                            <input type="text" x-model="h.header" placeholder="Authorization" class="flex-1 font-mono">
+                            <input type="password" x-model="h.value" class="flex-1"
+                                   :placeholder="h.has_existing_value ? '{% translate '🔒 keep existing'|escapejs %}' : '{% translate 'value'|escapejs %}'">
+                        </div>
+                        <p x-show="hostError(i)" x-cloak class="mt-1 text-xs text-red-400" x-text="hostError(i)"></p>
+                    </div>
+                </template>
+
+                <button type="button" @click="addHost()" class="btn-secondary mt-3 text-sm">
+                    + {% translate "Add host" %}
+                </button>
+            </div>
+
+            <input type="hidden" name="egress_json" :value="JSON.stringify(serialised)">
+            {% if form.egress_json.errors %}
+            <p class="mt-1.5 text-sm text-red-400">{{ form.egress_json.errors.0 }}</p>
+            {% endif %}
+        </fieldset>
+    </div>
+
+    <div class="border-t border-white/[0.06]"></div>
+
     <div x-data="resourceControl({
-              network: '{{ form.network_choice.value|default:'default'|escapejs }}',
               memValue: '{{ form.memory_value.value|default:''|escapejs }}',
               memUnit: '{{ form.memory_unit.value|default:'MiB'|escapejs }}',
               cpuValue: '{{ form.cpus.value|default:''|escapejs }}',
               forceOpen: {% if is_default_form %}true{% else %}false{% endif %},
-              hasErrors: {% if form.network_choice.errors or form.memory_value.errors or form.memory_unit.errors or form.cpus.errors %}true{% else %}false{% endif %},
+              hasErrors: {% if form.memory_value.errors or form.memory_unit.errors or form.cpus.errors %}true{% else %}false{% endif %},
           })">
         <button type="button" @click="resourcesOpen = !resourcesOpen"
                 class="inline-flex items-center gap-1 text-[13px] font-medium text-gray-300 hover:text-white">
@@ -170,43 +274,11 @@
             {% translate "Resources" %}
         </button>
         <p x-show="!resourcesOpen" x-cloak class="mt-1.5 text-sm text-gray-500">
-            {% translate "Inherits network, memory, and CPUs from the global default. Click to override." %}
+            {% translate "Inherits memory and CPUs from the global default. Click to override." %}
         </p>
 
         <div x-show="resourcesOpen" x-cloak class="mt-4 space-y-5 border-l-2 border-white/[0.06] pl-4">
 
-            {# Network #}
-            <div>
-                <label class="block text-[15px] font-medium text-gray-400">
-                    {% translate "Network" %}
-                    {% if form.network_choice.field.disabled %}{% include "core/_env_lock_badge.html" %}{% endif %}
-                </label>
-                <div class="mt-2 flex flex-wrap items-center gap-1 rounded-xl border border-white/[0.06] bg-white/[0.02] p-1">
-                    <label class="cursor-pointer rounded-lg px-3 py-1.5 text-sm font-medium transition-all duration-200"
-                           :class="network === 'default' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'"
-                           {% if form.network_choice.field.disabled %}aria-disabled="true" style="pointer-events:none;opacity:0.6;"{% endif %}>
-                        <input type="radio" name="network_choice" value="default" x-model="network" class="sr-only"
-                               {% if form.network_choice.field.disabled %}disabled{% endif %}>
-                        {% if is_default_form %}{% translate "Unconstrained" %}{% else %}{% translate "Use default" %}{% if global_default_summary.has_network %} — {{ global_default_summary.network }}{% endif %}{% endif %}
-                    </label>
-                    <label class="cursor-pointer rounded-lg px-3 py-1.5 text-sm font-medium transition-all duration-200"
-                           :class="network === 'on' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'"
-                           {% if form.network_choice.field.disabled %}aria-disabled="true" style="pointer-events:none;opacity:0.6;"{% endif %}>
-                        <input type="radio" name="network_choice" value="on" x-model="network" class="sr-only"
-                               {% if form.network_choice.field.disabled %}disabled{% endif %}>
-                        {% translate "On" %}
-                    </label>
-                    <label class="cursor-pointer rounded-lg px-3 py-1.5 text-sm font-medium transition-all duration-200"
-                           :class="network === 'off' ? 'bg-white/[0.1] text-white shadow-sm' : 'text-gray-400 hover:text-gray-300'"
-                           {% if form.network_choice.field.disabled %}aria-disabled="true" style="pointer-events:none;opacity:0.6;"{% endif %}>
-                        <input type="radio" name="network_choice" value="off" x-model="network" class="sr-only"
-                               {% if form.network_choice.field.disabled %}disabled{% endif %}>
-                        {% translate "Off" %}
-                    </label>
-                </div>
-                {% if form.network_choice.errors %}<p class="mt-1.5 text-sm text-red-400">{{ form.network_choice.errors.0 }}</p>{% endif %}
-            </div>
-
             {# Memory #}
             <div>
                 <label class="block text-[15px] font-medium text-gray-400">
diff --git a/daiv/sandbox_envs/templates/sandbox_envs/_scripts.html b/daiv/sandbox_envs/templates/sandbox_envs/_scripts.html
index b9d751352..a5ac5de67 100644
--- a/daiv/sandbox_envs/templates/sandbox_envs/_scripts.html
+++ b/daiv/sandbox_envs/templates/sandbox_envs/_scripts.html
@@ -1,6 +1,7 @@
 {% load static %}
 <script defer src="{% static 'sandbox_envs/js/env-vars-editor.js' %}"></script>
 <script defer src="{% static 'sandbox_envs/js/repo-ids-editor.js' %}"></script>
+<script defer src="{% static 'sandbox_envs/js/egress-editor.js' %}"></script>
 <script defer src="{% static 'sandbox_envs/js/resource-control.js' %}"></script>
 <script defer src="{% static 'sandbox_envs/js/env-drawer.js' %}"></script>
 <script defer src="{% static 'sandbox_envs/js/env-picker.js' %}"></script>
diff --git a/docker-compose.yml b/docker-compose.yml
index a8d3b76c0..4e6c01295 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -173,6 +173,9 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./../daiv-sandbox/daiv_sandbox:/home/app/daiv_sandbox
+      # Shared egress CA (cert + key) read by the service to provision per-session MITM sidecars.
+      # See DAIV_SANDBOX_EGRESS_CA_*_FILE in docker/local/sandbox/config.env.
+      - ./data/certs:/home/app/certs:ro
     depends_on:
       redis:
         condition: service_healthy
diff --git a/docker/local/sandbox/config.env b/docker/local/sandbox/config.env
index 1ead9ece6..1d03ca8b5 100644
--- a/docker/local/sandbox/config.env
+++ b/docker/local/sandbox/config.env
@@ -3,11 +3,12 @@ DAIV_SANDBOX_RUNTIME=runsc
 DAIV_SANDBOX_LOG_LEVEL=DEBUG
 DAIV_SANDBOX_ENVIRONMENT=local
 DAIV_SANDBOX_REDIS_URL=redis://redis:6379/1
-# Attach network-enabled cmd-executor containers to the compose network so they can
-# reach sibling services (e.g. gitlab:8929).
+# Upstream network for the egress sidecar's second NIC (its route out). Pinned to the compose
+# network so the proxy can reach sibling services (e.g. gitlab:8929). Network-enabled sandboxes
+# never attach here directly — they egress only through the per-session proxy.
 DAIV_SANDBOX_NETWORK=daiv_default
-# Under gVisor (runsc) the cmd-executor can't use Docker's embedded resolver (127.0.0.11) that the
-# user-defined network injects, so resolv.conf is repointed at real upstreams (DAIV_SANDBOX_DNS,
-# default 1.1.1.1,8.8.8.8) for external names, and these sibling services are pinned in /etc/hosts.
-DAIV_SANDBOX_EXTRA_HOSTS=gitlab
-
+# Shared egress CA. Setting both enables network egress: a network-enabled session is built as a
+# triad (internal network + mitmdump sidecar + sandbox) and reaches the internet only through the
+# proxy. Paths point at ./data/certs, mounted read-only into the container (see docker-compose.yml).
+DAIV_SANDBOX_EGRESS_CA_CERT_FILE=/home/app/certs/egress-ca.crt
+DAIV_SANDBOX_EGRESS_CA_KEY_FILE=/home/app/certs/egress-ca.key
diff --git a/docs/features/sandbox-environments.md b/docs/features/sandbox-environments.md
index 4a7b2ca1c..c08add2e3 100644
--- a/docs/features/sandbox-environments.md
+++ b/docs/features/sandbox-environments.md
@@ -37,11 +37,12 @@ Click **Create** on the list page to open the drawer (`/dashboard/sandbox-envs/c
 | **Base image** | The container image the sandbox runs, e.g. `python:3.14-slim`. Required |
 | **CPUs** | CPU limit (a number, up to two decimals). Switch from *default* to *custom* to set it; leave on *default* to inherit |
 | **Memory** | Memory limit, entered as a value plus a **MiB** or **GiB** unit. Switch from *default* to *custom* to set it |
-| **Network** | **Use default**, **On**, or **Off**. Controls outbound network access (needed to reach package registries) |
+| **Network** | **On** or **Off**. Controls outbound network access (needed to reach package registries) |
 | **Environment variables** | Name/value pairs injected into the sandbox; mark any as secret (see below). Up to 100 entries |
+| **Egress policy** | Per-host outbound rules, injected credentials, and traffic mode. Shown only when **Network** is **On** (see [Network access and egress policy](#network-access-and-egress-policy)) |
 | **Repositories** | The repository IDs this environment is bound to, as slash-separated paths like `owner/repo` or `group/subgroup/repo` (see [Repository bindings](#repository-bindings)) |
 
-Leaving **CPUs**, **Memory**, or **Network** on *default* means the field is unset, and the value falls back to the global default's value (or the built-in runtime default) at run time.
+Leaving **CPUs** or **Memory** on *default* means the field is unset, and the value falls back to the global default's value (or the built-in runtime default) at run time. **Network** is explicit per environment (**On**/**Off**) and is *not* inherited from the global default — see [How an environment is resolved](#how-an-environment-is-resolved).
 
 ### Environment variables (encrypted at rest)
 
@@ -54,6 +55,44 @@ Environment-variable values are **Fernet-encrypted before they are stored** and
 !!! warning "Rotating the encryption key"
     If `DAIV_ENCRYPTION_KEY` changes and stored values can no longer be decrypted, the form blocks saving until you re-enter every secret value. Agent runs don't crash on this — they drop the unreadable variables and continue.
 
+### Network access and egress policy
+
+When **Network** is enabled, the **Egress** section appears at the bottom of the form. It lets you define exactly which outbound connections the sandbox container may make, with optional per-host credentials injected by the MITM proxy — credentials never enter the container.
+
+!!! info "Requires the egress proxy"
+    Egress policy is provisioned by the daiv-sandbox MITM egress proxy. If the sandbox does not have the egress proxy enabled, starting a run that uses an egress-configured environment will **abort** (fail-closed) rather than fall back to unrestricted network.
+
+!!! note "The repository's git platform is always reachable"
+    DAIV runs git — including the publish push — from *inside* the sandbox, so the run's own git platform (GitLab/GitHub) is **always allowed and authenticated**, even when **Network** is **Off**. DAIV injects a runtime-only rule for the platform host (credentialed with a short-lived, platform-minted token — project-scoped on GitLab, installation-scoped on GitHub) so `git fetch`/clone/push of the repository works without you listing it. You never configure this — and a **Network Off** environment is otherwise still fully isolated: it is opened *only* for the git platform, and only when a push token exists (eval/benchmark runs, which hold none, stay completely network-isolated).
+
+#### Allowed hosts
+
+Each row in the **Allowed hosts** table defines one outbound rule:
+
+| Column | Description |
+|--------|-------------|
+| **Host** | A hostname or glob pattern (e.g. `pypi.org`, `*.github.com`). Requests to hosts not on this list are blocked |
+| **Methods** | HTTP methods this rule applies to (leave empty to match all methods) |
+| **Credential** | Optional: an HTTP header name and value injected by the proxy for every request to this host (see below) |
+
+With **Default** set to `deny`, only the listed hosts are reachable and every other outbound request is blocked. When **Network** is **On** the policy must permit *something*: add at least one allowed-host rule, or set **Default** to `allow` — saving **On** with an empty allow-list and a `deny` default is rejected with a validation error. To block all general outbound traffic, set **Network** to **Off** instead; that stores **no** egress policy on the environment, while the repository's own git platform stays reachable so DAIV can still publish (see the note above).
+
+#### Per-host credentials (encrypted at rest)
+
+Each allowed host may carry an optional credential — an HTTP header name and value (for example, `Authorization` / `Bearer <token>`) that the proxy injects into matching requests. Credential values are **Fernet-encrypted before they are stored** and never rendered back to the browser or returned by the API/MCP; once saved, the value field shows an empty input with a *🔒 keep existing* placeholder. Re-saving the form preserves a stored credential unchanged unless you explicitly type a new value.
+
+Limits: at most **100** allowed-host rules and **100** credentials, and the encrypted secrets blob may not exceed **32 KiB**.
+
+#### Traffic mode
+
+The **Default** toggle controls how the MITM proxy handles unmatched traffic:
+
+| Toggle | Options | Description |
+|--------|---------|-------------|
+| **Default** | `deny` / `allow` | What happens to requests that do not match any allowed-host rule. `deny` (the recommended default) blocks them; `allow` passes them through unrestricted |
+
+The proxy always performs TLS interception on every reachable host — this is what lets it inject per-host credentials and enforce per-host HTTP-method restrictions. (TLS inspection is not configurable.)
+
 ### Repository bindings
 
 The **Repositories** field is a list of repository IDs (`owner/repo`, `group/subgroup/repo`, …) that this environment claims. Bindings drive [auto-resolution](#how-an-environment-is-resolved): when an agent runs in a bound repository and no environment is explicitly selected, this environment is chosen automatically.
@@ -70,7 +109,7 @@ When a run starts in a repository, DAIV picks the per-run environment using this
 4. **Global default** — the single **Global** environment marked as default.
 5. **None** — if nothing matches, the sandbox uses its built-in runtime defaults (no base image, networking off).
 
-The selected per-run environment is then **merged with the global default** to produce the effective runtime: for each resource field (base image, network, memory, CPUs) the per-run environment wins when it sets a value, otherwise the global default's value applies, otherwise the runtime default. Environment variables from both are unioned, with the per-run environment's keys shadowing the global default's.
+The selected per-run environment is then **merged with the global default** to produce the effective runtime: for each resource field (base image, memory, CPUs) the per-run environment wins when it sets a value, otherwise the global default's value applies, otherwise the runtime default. **Network (egress) is the exception — it is explicit per environment and is never inherited**: a per-run environment with **Network** off does not inherit the global default's egress policy (only the repository's own git platform stays reachable, so DAIV can publish). Environment variables from both are unioned, with the per-run environment's keys shadowing the global default's.
 
 !!! note "Webhook-triggered runs"
     Runs triggered by a webhook (for example, [issue addressing](issue-addressing.md)) have no signed-in DAIV user, so step 2 (User bindings) is skipped — resolution starts at Global bindings and falls back to the global default.
diff --git a/tests/unit_tests/automation/agent/middlewares/test_sandbox.py b/tests/unit_tests/automation/agent/middlewares/test_sandbox.py
index 4fd96011b..3223e2b5e 100644
--- a/tests/unit_tests/automation/agent/middlewares/test_sandbox.py
+++ b/tests/unit_tests/automation/agent/middlewares/test_sandbox.py
@@ -1,6 +1,7 @@
 import io
 import json
 import tarfile
+from contextlib import contextmanager
 from typing import TYPE_CHECKING
 from unittest.mock import AsyncMock, MagicMock, Mock, patch
 
@@ -11,6 +12,7 @@
 from automation.agent.middlewares.sandbox import (
     SANDBOX_SYSTEM_PROMPT,
     BashFailure,
+    SandboxEgressUnavailableError,
     SandboxMiddleware,
     _run_bash_commands,
 )
@@ -42,7 +44,6 @@ def _make_sandbox_runtime(disallow=(), allow=()):
 
     return SandboxRuntime(
         base_image="python:3.12",
-        network_enabled=False,
         memory_bytes=None,
         cpus=None,
         env_vars={},
@@ -89,10 +90,10 @@ def _make_runtime() -> MagicMock:
     runtime = MagicMock()
     sb = runtime.context.sandbox
     sb.base_image = "img"
-    sb.network_enabled = False
     sb.memory_bytes = 1
     sb.cpus = 1
     sb.env_vars = None
+    sb.egress = None
     runtime.context.gitrepo.working_dir = "/tmp/repo"  # noqa: S108
     return runtime
 
@@ -642,12 +643,14 @@ async def test_abefore_agent_builds_start_session_from_ctx_sandbox(self, tmp_pat
         runtime.context.config = Mock()
         runtime.context.config.sandbox = Mock()
         runtime.context.config.sandbox.base_image = None  # Would fail if read.
-        runtime.context.config.sandbox.network_enabled = None
         runtime.context.config.sandbox.memory_bytes = None
         runtime.context.config.sandbox.cpus = None
+        from core.sandbox.schemas import EgressConfigRequest, EgressPolicy
+
+        egress = EgressConfigRequest(policy=EgressPolicy(default="allow"))
         runtime.context.sandbox = SandboxRuntime(
             base_image="alpine:test",
-            network_enabled=True,
+            egress=egress,
             memory_bytes=1_234,
             cpus=2.5,
             env_vars={"X": "y"},
@@ -676,7 +679,7 @@ async def fake_start_session(req: StartSessionRequest) -> str:
         req = captured["req"]
         assert isinstance(req, StartSessionRequest)
         assert req.base_image == "alpine:test"
-        assert req.network_enabled is True
+        assert req.egress == egress
         assert req.memory_bytes == 1_234
         assert req.cpus == 2.5
         assert req.environment == {"X": "y"}
@@ -705,7 +708,6 @@ async def test_check_command_policy_reads_from_ctx_sandbox(self, tmp_path: Path)
         context.config.sandbox.command_policy.allow = ()
         context.sandbox = SandboxRuntime(
             base_image="alpine:test",
-            network_enabled=False,
             memory_bytes=None,
             cpus=None,
             env_vars={},
@@ -761,3 +763,103 @@ async def test_soft_fails_to_false_on_transport_error(self):
 
         client = Mock(session_exists=AsyncMock(side_effect=httpx.HTTPError("boom")))
         assert await SandboxMiddleware._session_exists(client, "warm-1") is False
+
+
+class TestSandboxEgress:
+    def _mw(self, client) -> SandboxMiddleware:
+        return SandboxMiddleware(
+            agent_root="/workspace/repo", client=client, sandbox_backend=SandboxFileBackend(client=client)
+        )
+
+    @staticmethod
+    @contextmanager
+    def _patch_archives():
+        """Stub the archive builders so the fresh-create path doesn't touch the filesystem."""
+        with (
+            patch("automation.agent.middlewares.sandbox._make_repo_archive", return_value=b""),
+            patch("automation.agent.middlewares.sandbox._make_global_skills_archive", return_value=None),
+        ):
+            yield
+
+    def _runtime_with_egress(self):
+        from core.sandbox.schemas import EgressConfigRequest, EgressPolicy
+
+        runtime = _make_runtime()
+        runtime.context.sandbox.egress = EgressConfigRequest(policy=EgressPolicy(default="allow"))
+        return runtime, runtime.context.sandbox.egress
+
+    async def test_no_configure_egress_on_fresh_create(self):
+        """Egress is attached at start_session time (via egress= field); configure_egress is never called."""
+        client = MagicMock()
+        client.start_session = AsyncMock(return_value="sess-e")
+        client.seed_session = AsyncMock()
+        client.configure_egress = AsyncMock()
+        runtime, _ = self._runtime_with_egress()
+        with self._patch_archives():
+            await self._mw(client).abefore_agent({}, runtime)
+        client.configure_egress.assert_not_awaited()
+
+    async def test_no_configure_egress_on_warm_reuse(self):
+        """Warm reuse no longer re-provisions egress; configure_egress is never called."""
+        client = MagicMock()
+        client.session_exists = AsyncMock(return_value=True)
+        client.start_session = AsyncMock()
+        client.configure_egress = AsyncMock()
+        runtime, _ = self._runtime_with_egress()
+        result = await self._mw(client).abefore_agent({"session_id": "sess-warm"}, runtime)
+        assert result == {"session_id": "sess-warm"}
+        client.start_session.assert_not_awaited()
+        client.configure_egress.assert_not_awaited()
+
+    async def test_skips_egress_when_none(self):
+        client = MagicMock()
+        client.start_session = AsyncMock(return_value="sess-x")
+        client.seed_session = AsyncMock()
+        client.configure_egress = AsyncMock()
+        runtime = _make_runtime()  # egress None — no egress configured
+        with self._patch_archives():
+            await self._mw(client).abefore_agent({}, runtime)
+        client.configure_egress.assert_not_awaited()
+
+    async def test_create_time_400_without_egress_detail_propagates_raw(self):
+        """A create-time 400 that does NOT mention 'egress' is re-raised as-is (not mapped)."""
+        import httpx
+
+        resp = httpx.Response(400, json={"detail": "base_image is invalid"})
+        client = MagicMock()
+        client.start_session = AsyncMock(
+            side_effect=httpx.HTTPStatusError("400", request=httpx.Request("POST", "x"), response=resp)
+        )
+        runtime, _ = self._runtime_with_egress()
+        with pytest.raises(httpx.HTTPStatusError) as raised:
+            await self._mw(client).abefore_agent({}, runtime)
+        assert not isinstance(raised.value, SandboxEgressUnavailableError)
+
+    async def test_start_passes_egress_block_and_no_separate_provision(self):
+        """start_session is called with egress set; no separate configure_egress call is made."""
+        import httpx  # noqa: F401 — ensure httpx import is available if needed
+
+        client = MagicMock()
+        client.start_session = AsyncMock(return_value="sess-egress")
+        client.seed_session = AsyncMock()
+        client.configure_egress = AsyncMock()
+        runtime, egress = self._runtime_with_egress()
+        with self._patch_archives():
+            await self._mw(client).abefore_agent({}, runtime)
+        sent = client.start_session.call_args.args[0]
+        assert sent.egress is not None
+        assert sent.egress == egress
+        client.configure_egress.assert_not_awaited()
+
+    async def test_create_time_400_egress_maps_to_unavailable(self):
+        """A create-time 400 with an egress detail is mapped to SandboxEgressUnavailableError."""
+        import httpx
+
+        resp = httpx.Response(400, json={"detail": "egress requires the egress proxy, which is not configured"})
+        client = MagicMock()
+        client.start_session = AsyncMock(
+            side_effect=httpx.HTTPStatusError("400", request=httpx.Request("POST", "x"), response=resp)
+        )
+        runtime, _ = self._runtime_with_egress()
+        with pytest.raises(SandboxEgressUnavailableError):
+            await self._mw(client).abefore_agent({}, runtime)
diff --git a/tests/unit_tests/codebase/clients/github/test_client.py b/tests/unit_tests/codebase/clients/github/test_client.py
index fd82caa8b..d7af2117c 100644
--- a/tests/unit_tests/codebase/clients/github/test_client.py
+++ b/tests/unit_tests/codebase/clients/github/test_client.py
@@ -426,3 +426,27 @@ def test_get_merge_request_by_branches_returns_none_when_empty(self, github_clie
         result = github_client.get_merge_request_by_branches("owner/repo", "feat-x", "main")
 
         assert result is None
+
+    def test_get_git_egress_credential_uses_installation_token(self, github_client):
+        import base64
+        from unittest.mock import Mock
+
+        github_client._integration.get_access_token.return_value = Mock(token="ghs-install")  # noqa: S106
+        repository = Repository(
+            pk=1,
+            slug="owner/repo",
+            name="repo",
+            clone_url="https://github.com/owner/repo.git",
+            html_url="https://github.com/owner/repo",
+            default_branch="main",
+            git_platform=GitPlatform.GITHUB,
+        )
+
+        cred = github_client.get_git_egress_credential(repository)
+
+        assert cred.host == "github.com"
+        assert cred.header == "Authorization"
+        assert cred.value.get_secret_value() == "Basic " + base64.b64encode(b"oauth2:ghs-install").decode()
+        github_client._integration.get_access_token.assert_called_once_with(
+            github_client.client_installation.id, permissions={"contents": "write"}
+        )
diff --git a/tests/unit_tests/codebase/clients/gitlab/test_client.py b/tests/unit_tests/codebase/clients/gitlab/test_client.py
index 3a5c45a71..b72fc3e7a 100644
--- a/tests/unit_tests/codebase/clients/gitlab/test_client.py
+++ b/tests/unit_tests/codebase/clients/gitlab/test_client.py
@@ -4,6 +4,7 @@
 from django.core.exceptions import ImproperlyConfigured
 
 import pytest
+from git import GitCommandError
 from gitlab.exceptions import GitlabCreateError, GitlabGetError
 
 from codebase.base import GitPlatform, MergeRequestCommit, MergeRequestDiffStats, Repository, User
@@ -14,6 +15,26 @@
     _is_source_branch_missing_error,
 )
 
+
+def test_git_egress_credential_for_token_builds_basic_oauth2_header():
+    import base64
+
+    from codebase.clients.base import GitEgressCredential
+
+    cred = GitEgressCredential.for_token(host="gitlab.example.com", token="tok-123")  # noqa: S106
+    assert cred.host == "gitlab.example.com"
+    assert cred.header == "Authorization"
+    assert cred.value.get_secret_value() == "Basic " + base64.b64encode(b"oauth2:tok-123").decode()
+
+
+def test_git_egress_credential_for_token_none_when_no_token():
+    from codebase.clients.base import GitEgressCredential
+
+    cred = GitEgressCredential.for_token(host="gitlab.example.com", token=None)
+    assert cred.host == "gitlab.example.com"
+    assert cred.value is None
+
+
 _POSITION = {
     "position_type": "text",
     "base_sha": "aaa",
@@ -155,6 +176,90 @@ def test_load_repo_raises_when_pat_is_missing(self, gitlab_client, clone_setup):
 
         clone_from.assert_not_called()
 
+    def test_load_repo_retries_with_fresh_token_when_cached_ephemeral_is_rejected(self, gitlab_client, clone_setup):
+        """A cached ephemeral token GitLab now rejects must be dropped and re-minted, not left to
+        wedge every clone of this project for the rest of the cache window."""
+        repository, clone_from, _ = clone_setup
+        mock_repo = clone_from.return_value
+        auth_error = GitCommandError(
+            "git clone", 128, "remote: HTTP Basic: Access denied\nfatal: Authentication failed for 'https://...'"
+        )
+        clone_from.side_effect = [auth_error, mock_repo]
+
+        with (
+            patch(
+                "codebase.clients.gitlab.client.get_ephemeral_clone_token", side_effect=["glpat-stale", "glpat-fresh"]
+            ),
+            patch("codebase.clients.gitlab.client.invalidate_clone_token") as invalidate,
+            gitlab_client.load_repo(repository, "main") as loaded_repo,
+        ):
+            assert loaded_repo == mock_repo
+
+        invalidate.assert_called_once_with(1)
+        assert clone_from.call_count == 2
+        assert clone_from.call_args_list[0].args[0] == "https://oauth2:glpat-stale@gitlab.com/group/repo.git"
+        assert clone_from.call_args_list[1].args[0] == "https://oauth2:glpat-fresh@gitlab.com/group/repo.git"
+
+    def test_load_repo_retries_exactly_once_then_propagates_when_fresh_token_also_rejected(
+        self, gitlab_client, clone_setup
+    ):
+        """The self-heal retries at most once: if the freshly minted token is also rejected, the
+        second failure propagates rather than looping. Pins 'retry once, then give up'."""
+        repository, clone_from, _ = clone_setup
+        auth_error = GitCommandError(
+            "git clone", 128, "remote: HTTP Basic: Access denied\nfatal: Authentication failed for 'https://...'"
+        )
+        clone_from.side_effect = [auth_error, auth_error]
+
+        with (
+            patch(
+                "codebase.clients.gitlab.client.get_ephemeral_clone_token", side_effect=["glpat-stale", "glpat-fresh"]
+            ),
+            patch("codebase.clients.gitlab.client.invalidate_clone_token") as invalidate,
+            pytest.raises(GitCommandError),
+            gitlab_client.load_repo(repository, "main"),
+        ):
+            pass
+
+        invalidate.assert_called_once_with(1)
+        assert clone_from.call_count == 2
+
+    def test_load_repo_does_not_retry_when_the_clone_used_the_pat(self, gitlab_client, clone_setup):
+        """Re-minting can't fix a clone that already used the PAT directly (no ephemeral token to
+        evict), so an auth-rejected PAT clone must surface immediately, not retry."""
+        repository, clone_from, _ = clone_setup
+        clone_from.side_effect = GitCommandError("git clone", 128, "fatal: Authentication failed for 'https://...'")
+
+        with (
+            patch("codebase.clients.gitlab.client.get_ephemeral_clone_token", return_value=None),
+            patch("codebase.clients.gitlab.client.invalidate_clone_token") as invalidate,
+            pytest.raises(GitCommandError),
+            gitlab_client.load_repo(repository, "main"),
+        ):
+            pass
+
+        invalidate.assert_not_called()
+        assert clone_from.call_count == 1
+
+    def test_load_repo_does_not_retry_non_auth_clone_failures(self, gitlab_client, clone_setup):
+        """A missing branch (or any non-auth 128) won't be fixed by a fresh credential, so it must
+        not trigger the token-rotation retry."""
+        repository, clone_from, _ = clone_setup
+        clone_from.side_effect = GitCommandError(
+            "git clone", 128, "fatal: Remote branch nope not found in upstream origin"
+        )
+
+        with (
+            patch("codebase.clients.gitlab.client.get_ephemeral_clone_token", return_value="glpat-eph"),
+            patch("codebase.clients.gitlab.client.invalidate_clone_token") as invalidate,
+            pytest.raises(GitCommandError),
+            gitlab_client.load_repo(repository, "main"),
+        ):
+            pass
+
+        invalidate.assert_not_called()
+        assert clone_from.call_count == 1
+
     def test_create_merge_request_inline_discussion_sends_position_payload(self, gitlab_client):
         """create_merge_request_inline_discussion must pass body + position dict to discussions.create."""
         mock_project = Mock()
@@ -611,3 +716,38 @@ def test_get_merge_request_by_branches_returns_none_when_empty(self, gitlab_clie
         result = gitlab_client.get_merge_request_by_branches("group/repo", "feat-x", "main")
 
         assert result is None
+
+    def _egress_repo(self):
+        return Repository(
+            pk=42,
+            slug="group/repo",
+            name="repo",
+            clone_url="https://gitlab.example.com/group/repo.git",
+            html_url="https://gitlab.example.com/group/repo",
+            default_branch="main",
+            git_platform=GitPlatform.GITLAB,
+        )
+
+    def test_get_git_egress_credential_uses_ephemeral_clone_token(self, gitlab_client):
+        import base64
+
+        with patch("codebase.clients.gitlab.client.get_ephemeral_clone_token", return_value="glpat-eph"):
+            cred = gitlab_client.get_git_egress_credential(self._egress_repo())
+        assert cred.host == "gitlab.example.com"
+        assert cred.header == "Authorization"
+        assert cred.value.get_secret_value() == "Basic " + base64.b64encode(b"oauth2:glpat-eph").decode()
+
+    def test_get_git_egress_credential_falls_back_to_pat(self, gitlab_client):
+        import base64
+
+        gitlab_client.client.private_token = "pat-token"  # noqa: S105
+        with patch("codebase.clients.gitlab.client.get_ephemeral_clone_token", return_value=None):
+            cred = gitlab_client.get_git_egress_credential(self._egress_repo())
+        assert cred.value.get_secret_value() == "Basic " + base64.b64encode(b"oauth2:pat-token").decode()
+
+    def test_get_git_egress_credential_no_token_returns_host_only(self, gitlab_client):
+        gitlab_client.client.private_token = None
+        with patch("codebase.clients.gitlab.client.get_ephemeral_clone_token", return_value=None):
+            cred = gitlab_client.get_git_egress_credential(self._egress_repo())
+        assert cred.host == "gitlab.example.com"
+        assert cred.value is None
diff --git a/tests/unit_tests/codebase/clients/gitlab/test_clone_tokens.py b/tests/unit_tests/codebase/clients/gitlab/test_clone_tokens.py
index 08954c32b..a0c893379 100644
--- a/tests/unit_tests/codebase/clients/gitlab/test_clone_tokens.py
+++ b/tests/unit_tests/codebase/clients/gitlab/test_clone_tokens.py
@@ -17,6 +17,7 @@
     CLONE_TOKEN_TRANSIENT_UNAVAILABLE_TIMEOUT,
     CLONE_TOKEN_UNAVAILABLE_TIMEOUT,
     get_ephemeral_clone_token,
+    invalidate_clone_token,
 )
 
 
@@ -141,6 +142,20 @@ def test_minted_token_is_cached_for_the_full_window(self, gl_client):
 
         assert cache_mock.set.call_args.args[2] == CLONE_TOKEN_CACHE_TIMEOUT
 
+    def test_invalidate_drops_the_cache_so_the_next_call_remints(self, gl_client):
+        """A token GitLab now rejects must be evictable so the next clone mints a fresh one
+        instead of being served the dead token for the rest of the cache window."""
+        assert get_ephemeral_clone_token(gl_client, 42) == "glpat-ephemeral"
+
+        invalidate_clone_token(42)
+
+        assert get_ephemeral_clone_token(gl_client, 42) == "glpat-ephemeral"
+        assert gl_client.projects.get.return_value.access_tokens.create.call_count == 2
+
+    def test_invalidate_is_a_noop_when_nothing_is_cached(self):
+        """Invalidating an absent entry must not raise (a clone can fail before anything was cached)."""
+        invalidate_clone_token(999)
+
     def test_tokens_are_cached_per_project(self, gl_client):
         project_a, project_b = Mock(), Mock()
         project_a.access_tokens.create.return_value = Mock(token="glpat-a")  # noqa: S106
diff --git a/tests/unit_tests/codebase/test_context.py b/tests/unit_tests/codebase/test_context.py
index 5f9242652..99f714935 100644
--- a/tests/unit_tests/codebase/test_context.py
+++ b/tests/unit_tests/codebase/test_context.py
@@ -39,6 +39,7 @@ async def test_set_runtime_ctx_builds_sandbox_field():
         client.get_repository.return_value = type("R", (), {"name": "x"})()
         client.git_platform = "gitlab"
         client.current_user.username = "bot"
+        client.get_git_egress_credential.return_value = None  # these tests assert env resolution, not egress
         ctx_mgr = client.load_repo.return_value
         ctx_mgr.__enter__.return_value = type("Repo", (), {})()
         ctx_mgr.__exit__ = lambda *a: None
@@ -64,6 +65,7 @@ async def test_set_runtime_ctx_honors_per_run_env(user_factory):
         client.get_repository.return_value = type("R", (), {"name": "x"})()
         client.git_platform = "gitlab"
         client.current_user.username = "bot"
+        client.get_git_egress_credential.return_value = None  # these tests assert env resolution, not egress
         ctx_mgr = client.load_repo.return_value
         ctx_mgr.__enter__.return_value = type("Repo", (), {})()
         ctx_mgr.__exit__ = lambda *a: None
@@ -94,6 +96,7 @@ async def test_set_runtime_ctx_auto_resolves_repo_env():
         client.get_repository.return_value = type("R", (), {"name": "x"})()
         client.git_platform = "gitlab"
         client.current_user.username = "bot"
+        client.get_git_egress_credential.return_value = None  # these tests assert env resolution, not egress
         ctx_mgr = client.load_repo.return_value
         ctx_mgr.__enter__.return_value = type("Repo", (), {})()
         ctx_mgr.__exit__ = lambda *a: None
@@ -119,6 +122,7 @@ async def test_set_runtime_ctx_auto_falls_back_to_global_default():
         client.get_repository.return_value = type("R", (), {"name": "x"})()
         client.git_platform = "gitlab"
         client.current_user.username = "bot"
+        client.get_git_egress_credential.return_value = None  # these tests assert env resolution, not egress
         ctx_mgr = client.load_repo.return_value
         ctx_mgr.__enter__.return_value = type("Repo", (), {})()
         ctx_mgr.__exit__ = lambda *a: None
@@ -138,6 +142,11 @@ def _patch_context_deps(*, sandbox_enabled: bool):
     repo_client.load_repo.return_value = nullcontext(MagicMock(working_dir="/tmp/repo"))  # noqa: S108
     sandbox = MagicMock()
     sandbox.enabled = sandbox_enabled
+    # No egress policy + no derivable credential => augment_sandbox_with_platform_egress is a no-op
+    # (it would otherwise call dataclasses.replace() on this MagicMock). These tests only exercise
+    # transport open/close.
+    sandbox.egress = None
+    repo_client.get_git_egress_credential.return_value = None
     return (
         patch.multiple(
             "codebase.context",
@@ -170,3 +179,119 @@ async def test_set_runtime_ctx_skips_transport_when_sandbox_disabled():
         async with set_runtime_ctx("repo-1", scope=RepoScope.GLOBAL):
             assert _run_sandbox_client.get() is None
         ctor.assert_not_called()
+
+
+async def test_set_runtime_ctx_injects_platform_egress_when_network_on():
+    """Network-on integration seam: set_runtime_ctx must resolve the repo's git-platform credential
+    via the client and land its allow-rule first on ``ctx.sandbox.egress`` (the only place all the
+    unit-tested egress pieces are wired together). Guards against the augmentation line being dropped
+    or reordered before merge_sandbox_runtime — a regression every isolated unit test would miss."""
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME
+
+    from codebase.clients.base import GitEgressCredential
+    from codebase.context import SandboxRuntime
+    from core.sandbox.command_policy import SandboxCommandPolicy
+    from core.sandbox.schemas import EgressConfigRequest
+
+    repo_client = MagicMock()
+    repository = MagicMock()
+    repo_client.get_repository.return_value = repository
+    repo_client.current_user.username = "daiv"
+    repo_client.load_repo.return_value = nullcontext(MagicMock(working_dir="/tmp/repo"))  # noqa: S108
+    repo_client.get_git_egress_credential.return_value = GitEgressCredential.for_token(
+        host="github.com",
+        token="tok",  # noqa: S106
+    )
+
+    # A real (frozen) SandboxRuntime with a networked egress policy (egress is not None == network on);
+    # augment_sandbox_with_platform_egress prepends the git-platform rule via dataclasses.replace().
+    sandbox = SandboxRuntime(
+        base_image="python:3.12",
+        memory_bytes=None,
+        cpus=None,
+        env_vars={},
+        command_policy=SandboxCommandPolicy(),
+        egress=EgressConfigRequest(),
+    )
+    fake_client = MagicMock()
+    fake_client.open = AsyncMock(return_value=fake_client)
+    fake_client.close = AsyncMock()
+
+    with (
+        patch.multiple(
+            "codebase.context",
+            RepoClient=MagicMock(create_instance=MagicMock(return_value=repo_client)),
+            RepositoryConfig=MagicMock(get_config=MagicMock(return_value=MagicMock(default_branch="main"))),
+            DAIVSandboxClient=MagicMock(return_value=fake_client),
+        ),
+        patch("sandbox_envs.services.resolve_env_for_run", AsyncMock(return_value=None)),
+        patch("sandbox_envs.services.get_global_default", AsyncMock(return_value=None)),
+        patch("sandbox_envs.services.merge_sandbox_runtime", MagicMock(return_value=sandbox)),
+        patch("sandbox_envs.services.row_to_override", MagicMock(return_value=None)),
+    ):
+        async with set_runtime_ctx("acme/repo", scope=RepoScope.GLOBAL) as ctx:
+            repo_client.get_git_egress_credential.assert_called_once_with(repository)
+            assert ctx.sandbox.egress is not None
+            platform_rule = ctx.sandbox.egress.policy.rules[0]
+            assert platform_rule.host == "github.com"
+            assert platform_rule.inject == PLATFORM_EGRESS_SECRET_NAME
+            assert PLATFORM_EGRESS_SECRET_NAME in ctx.sandbox.egress.secrets
+
+
+async def test_set_runtime_ctx_resolves_platform_egress_after_clone():
+    """Regression guard for the egress/clone token-divergence bug: the git-platform credential must be
+    resolved AFTER load_repo() clones, so it observes any token the GitLab clone self-heal re-minted.
+    The egress proxy overrides Authorization on every platform request, so a credential captured before
+    a self-healing clone would pin the sidecar to the stale token the clone just discarded — breaking
+    the in-sandbox push. Asserts clone happens before credential resolution."""
+    from codebase.clients.base import GitEgressCredential
+    from codebase.context import SandboxRuntime
+    from core.sandbox.command_policy import SandboxCommandPolicy
+
+    calls: list[str] = []
+    repo_client = MagicMock()
+    repository = MagicMock()
+    repo_client.get_repository.return_value = repository
+    repo_client.current_user.username = "daiv"
+
+    clone_repo = MagicMock(working_dir="/tmp/repo")  # noqa: S108
+    cm = MagicMock()
+    cm.__enter__ = MagicMock(side_effect=lambda: calls.append("clone") or clone_repo)
+    cm.__exit__ = MagicMock(return_value=False)
+    repo_client.load_repo.return_value = cm
+
+    def _cred(repo):
+        calls.append("credential")
+        return GitEgressCredential.for_token(host="github.com", token="tok")  # noqa: S106
+
+    repo_client.get_git_egress_credential.side_effect = _cred
+
+    # Network-off env (egress=None): a push token still opens it for the git platform host.
+    sandbox = SandboxRuntime(
+        base_image="python:3.12",
+        memory_bytes=None,
+        cpus=None,
+        env_vars={},
+        command_policy=SandboxCommandPolicy(),
+        egress=None,
+    )
+    fake_client = MagicMock()
+    fake_client.open = AsyncMock(return_value=fake_client)
+    fake_client.close = AsyncMock()
+
+    with (
+        patch.multiple(
+            "codebase.context",
+            RepoClient=MagicMock(create_instance=MagicMock(return_value=repo_client)),
+            RepositoryConfig=MagicMock(get_config=MagicMock(return_value=MagicMock(default_branch="main"))),
+            DAIVSandboxClient=MagicMock(return_value=fake_client),
+        ),
+        patch("sandbox_envs.services.resolve_env_for_run", AsyncMock(return_value=None)),
+        patch("sandbox_envs.services.get_global_default", AsyncMock(return_value=None)),
+        patch("sandbox_envs.services.merge_sandbox_runtime", MagicMock(return_value=sandbox)),
+        patch("sandbox_envs.services.row_to_override", MagicMock(return_value=None)),
+    ):
+        async with set_runtime_ctx("acme/repo", scope=RepoScope.GLOBAL) as ctx:
+            assert calls == ["clone", "credential"], f"credential must resolve after clone, got {calls}"
+            assert ctx.sandbox.egress is not None
+            assert ctx.sandbox.egress.policy.rules[0].host == "github.com"
diff --git a/tests/unit_tests/core/sandbox/test_client.py b/tests/unit_tests/core/sandbox/test_client.py
index 5a6ac03df..146cb8414 100644
--- a/tests/unit_tests/core/sandbox/test_client.py
+++ b/tests/unit_tests/core/sandbox/test_client.py
@@ -358,3 +358,49 @@ def test_is_transient_sandbox_error_true_for_request_error_with_no_response():
     from core.sandbox.client import is_transient_sandbox_error
 
     assert is_transient_sandbox_error(httpx.ConnectError("refused")) is True
+
+
+async def test_start_session_sends_egress_with_plaintext_secret(fake_settings, httpx_mock):
+    import json
+
+    from core.sandbox.client import DAIVSandboxClient
+    from core.sandbox.schemas import EgressConfigRequest, StartSessionRequest
+
+    httpx_mock.add_response(json={"session_id": "s1"})
+    req = StartSessionRequest(
+        base_image="python:3.14",
+        egress=EgressConfigRequest.from_stored(
+            {"default": "deny", "rules": [{"host": "gitlab.com", "inject": "tok"}]},
+            {"tok": {"header": "PRIVATE-TOKEN", "value": "supersecret"}},
+        ),
+    )
+    async with DAIVSandboxClient() as client:
+        assert await client.start_session(req) == "s1"
+    body = httpx_mock.get_requests()[0].read().decode()
+    assert "supersecret" in body  # plaintext reached the wire
+    assert "**********" not in body  # not the SecretStr mask
+    # The egress block is rebuilt by hand (model_dump masks SecretStr); assert the wire SHAPE, not
+    # just substring presence, so a key typo (e.g. "head" for "header") is caught.
+    egress = json.loads(body)["egress"]
+    assert egress["secrets"]["tok"] == {"header": "PRIVATE-TOKEN", "value": "supersecret"}
+    assert egress["policy"]["default"] == "deny"
+    assert egress["policy"]["rules"][0] == {"host": "gitlab.com", "methods": ["*"], "inject": "tok"}
+
+
+async def test_start_session_sends_policy_only_egress_with_empty_secrets(fake_settings, httpx_mock):
+    """An allow-all / no-credential policy serialises with an empty ``secrets`` map (a common shape)."""
+    import json
+
+    from core.sandbox.client import DAIVSandboxClient
+    from core.sandbox.schemas import EgressConfigRequest, StartSessionRequest
+
+    httpx_mock.add_response(json={"session_id": "s1"})
+    req = StartSessionRequest(
+        base_image="python:3.14", egress=EgressConfigRequest.from_stored({"default": "allow", "rules": []}, {})
+    )
+    async with DAIVSandboxClient() as client:
+        assert await client.start_session(req) == "s1"
+    egress = json.loads(httpx_mock.get_requests()[0].read().decode())["egress"]
+    assert egress["secrets"] == {}
+    assert egress["policy"]["default"] == "allow"
+    assert egress["policy"]["rules"] == []
diff --git a/tests/unit_tests/core/sandbox/test_schema_consistency.py b/tests/unit_tests/core/sandbox/test_schema_consistency.py
index 649739d0e..72e77cd9c 100644
--- a/tests/unit_tests/core/sandbox/test_schema_consistency.py
+++ b/tests/unit_tests/core/sandbox/test_schema_consistency.py
@@ -47,6 +47,11 @@ def _normalize(schema):
     "FsEditResponse",
     "FsDeleteRequest",
     "FsDeleteResponse",
+    "EgressRule",
+    "EgressSecret",
+    "EgressPolicy",
+    "EgressConfigRequest",
+    "EgressConfigResponse",
 ]
 
 # Types that exist on both sides but are deliberately allowed to diverge.
diff --git a/tests/unit_tests/core/sandbox/test_schemas.py b/tests/unit_tests/core/sandbox/test_schemas.py
index 64942ffe7..c2249a9aa 100644
--- a/tests/unit_tests/core/sandbox/test_schemas.py
+++ b/tests/unit_tests/core/sandbox/test_schemas.py
@@ -82,3 +82,84 @@ def test_fs_delete_response_removed_and_ok():
 
     failed = FsDeleteResponse(error=FsError(code=FsErrorCode.IS_A_DIRECTORY, message="is a directory"))
     assert failed.ok is False and failed.error.code is FsErrorCode.IS_A_DIRECTORY
+
+
+def test_egress_rule_uppercases_methods_and_rejects_empty():
+    from core.sandbox.schemas import EgressRule
+
+    assert EgressRule(host="x", methods=["get", "post"]).methods == ["GET", "POST"]
+    with pytest.raises(ValueError):
+        EgressRule(host="x", methods=[])
+
+
+def test_egress_rule_rejects_blank_and_crlf_host():
+    """Host validity is enforced on the type (not only the form) so from_stored/apply_platform_egress
+    can't carry a blank or CR/LF-smuggled host through to the sidecar. A surrounding-whitespace host
+    is normalised."""
+    from core.sandbox.schemas import EgressRule
+
+    assert EgressRule(host="  github.com  ").host == "github.com"
+    with pytest.raises(ValueError, match="blank"):
+        EgressRule(host="   ")
+    with pytest.raises(ValueError, match="CR or LF"):
+        EgressRule(host="github.com\r\nHost: evil.example")
+
+
+def test_egress_secret_rejects_crlf_and_blank_header_and_value():
+    """Header-injection vectors are rejected at the parse boundary for every construction path."""
+    from pydantic import SecretStr
+
+    from core.sandbox.schemas import EgressSecret
+
+    with pytest.raises(ValueError, match="CR or LF"):
+        EgressSecret(header="Authorization\r\nX-Evil: 1", value=SecretStr("Bearer t"))
+    with pytest.raises(ValueError, match="blank"):
+        EgressSecret(header="  ", value=SecretStr("Bearer t"))
+    with pytest.raises(ValueError, match="CR or LF"):
+        EgressSecret(header="Authorization", value=SecretStr("Bearer t\r\nX-Evil: 1"))
+
+
+def test_egress_config_request_rejects_dangling_inject():
+    from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule
+
+    with pytest.raises(ValueError, match="unknown secret"):
+        EgressConfigRequest(policy=EgressPolicy(rules=[EgressRule(host="x", inject="missing")]), secrets={})
+
+
+def test_empty_egress_config_request_is_deny_all():
+    """The fail-closed fallback in ``row_to_override`` substitutes a bare ``EgressConfigRequest()``
+    for an unusable stored config. That is only safe while the empty request denies everything — a
+    future flip of ``EgressPolicy.default`` to ``allow`` would silently turn the fallback fail-open."""
+    from core.sandbox.schemas import EgressConfigRequest
+
+    req = EgressConfigRequest()
+    assert req.policy.default == "deny"
+    assert req.policy.rules == []
+    assert req.secrets == {}
+
+
+def test_egress_secret_value_is_redacted_in_repr():
+    from pydantic import SecretStr
+
+    from core.sandbox.schemas import EgressSecret
+
+    s = EgressSecret(header="Authorization", value=SecretStr("Bearer t"))
+    assert "Bearer t" not in repr(s)
+    assert s.value.get_secret_value() == "Bearer t"
+
+
+def test_to_wire_unwraps_secret_and_carries_every_policy_field():
+    """``to_wire`` must send plaintext secrets AND every ``EgressPolicy`` field. Pinning the policy
+    block to ``model_dump`` guards against the hand-built wire dict silently dropping a field added
+    to ``EgressPolicy`` later (the reason ``to_wire`` exists instead of inlining in the client)."""
+    from core.sandbox.schemas import EgressConfigRequest, EgressPolicy
+
+    req = EgressConfigRequest.from_stored(
+        {"default": "deny", "intercept": "credentialed", "rules": [{"host": "gitlab.com", "inject": "tok"}]},
+        {"tok": {"header": "PRIVATE-TOKEN", "value": "supersecret"}},
+    )
+    wire = req.to_wire()
+    assert wire["secrets"] == {"tok": {"header": "PRIVATE-TOKEN", "value": "supersecret"}}
+    # Every field of the policy schema is present (no silent drop) and the masked dump is not used.
+    assert set(wire["policy"]) == set(EgressPolicy.model_fields)
+    assert wire["policy"]["intercept"] == "credentialed"
diff --git a/tests/unit_tests/core/test_utils.py b/tests/unit_tests/core/test_utils.py
index 6ee419ef0..61f91a38a 100644
--- a/tests/unit_tests/core/test_utils.py
+++ b/tests/unit_tests/core/test_utils.py
@@ -9,6 +9,7 @@
     build_absolute_url,
     build_uri,
     extract_valid_image_mimetype,
+    is_git_auth_error_text,
     is_valid_url,
     prefixed_email_subject,
 )
@@ -48,6 +49,39 @@ def test_returns_subject_unchanged_when_site_missing(self, mocker):
         assert prefixed_email_subject("Welcome") == "Welcome"
 
 
+class IsGitAuthErrorTextTest:
+    """Direct contract test for the shared marker set used by both the clone-retry self-heal
+    (codebase.clients.gitlab) and the push-failure classifier (automation.agent.git_manager).
+    A marker dropped here silently widens or narrows both behaviours, so pin them explicitly."""
+
+    @pytest.mark.parametrize(
+        "text",
+        [
+            "fatal: Authentication failed for 'https://gitlab.example/acme/repo.git'",
+            "remote: HTTP Basic: Access denied",  # subsumed by "access denied"
+            "The requested URL returned error: 403",
+            "fatal: could not read Username for 'https://...': terminal prompts disabled",
+            "remote: Permission denied",
+            "remote: You are not authorized to push to this repository",
+            "AUTHENTICATION FAILED",  # case-insensitive
+        ],
+    )
+    def test_auth_markers_return_true(self, text):
+        assert is_git_auth_error_text(text) is True
+
+    @pytest.mark.parametrize(
+        "text",
+        [
+            "fatal: unable to access 'https://...': Could not resolve host",
+            "fatal: couldn't find remote ref refs/heads/missing",
+            "",
+            "Everything up-to-date",
+        ],
+    )
+    def test_non_auth_text_returns_false(self, text):
+        assert is_git_auth_error_text(text) is False
+
+
 class IsValidUrlTest:
     def test_valid_url_returns_true(self):
         assert is_valid_url("https://example.com/image.jpg") is True
diff --git a/tests/unit_tests/mcp_server/test_server_envs.py b/tests/unit_tests/mcp_server/test_server_envs.py
index 583979ce6..2e6b4d649 100644
--- a/tests/unit_tests/mcp_server/test_server_envs.py
+++ b/tests/unit_tests/mcp_server/test_server_envs.py
@@ -91,6 +91,33 @@ async def test_get_environment_masks_secrets():
     assert by_name["SEC"] == "******"
 
 
+@pytest.mark.django_db(transaction=True)
+async def test_get_environment_network_enabled_derived_from_egress_policy():
+    """The MCP ``network_enabled`` output key is derived from ``egress_policy`` presence (the
+    ``network_enabled`` column is gone). Assert both branches so an inverted condition is caught."""
+    from accounts.models import User
+
+    await SandboxEnvironment.objects.filter(scope=Scope.GLOBAL).adelete()
+    user = await User.objects.acreate_user(username="u", email="u@e.com", password="x")  # noqa: S106
+    await SandboxEnvironment.objects.acreate(
+        scope=Scope.USER,
+        user=user,
+        name="net",
+        base_image="alpine:latest",
+        egress_policy={"default": "deny", "intercept": "all", "rules": []},
+    )
+    await SandboxEnvironment.objects.acreate(
+        scope=Scope.USER, user=user, name="nonet", base_image="alpine:latest", egress_policy=None
+    )
+    from mcp_server.server import get_environment
+
+    with patch("mcp_server.server.get_current_user", new=AsyncMock(return_value=user)):
+        networked = await get_environment("net")
+        isolated = await get_environment("nonet")
+    assert networked is not None and networked["network_enabled"] is True
+    assert isolated is not None and isolated["network_enabled"] is False
+
+
 @pytest.mark.django_db(transaction=True)
 async def test_get_environment_unknown_returns_none():
     from accounts.models import User
diff --git a/tests/unit_tests/sandbox_envs/test_forms.py b/tests/unit_tests/sandbox_envs/test_forms.py
index 5bde71666..6aaf1bd16 100644
--- a/tests/unit_tests/sandbox_envs/test_forms.py
+++ b/tests/unit_tests/sandbox_envs/test_forms.py
@@ -8,6 +8,43 @@
 from sandbox_envs.forms import SandboxEnvironmentForm
 from sandbox_envs.models import SandboxEnvironment, Scope
 
+
+@pytest.fixture
+def make_form_data():
+    """Return a factory that builds minimal valid POST data for SandboxEnvironmentForm,
+    with any keyword argument overriding the default. Callers supply ``network_choice``
+    and ``egress_json`` to exercise the network toggle logic."""
+
+    def _factory(**overrides):
+        base = {
+            "name": "dev",
+            "base_image": "alpine",
+            "scope": Scope.USER,
+            "network_choice": "off",
+            "memory_mode": "default",
+            "cpu_mode": "default",
+            "memory_unit": "MiB",
+            "env_vars_json": "[]",
+            "repo_ids_json": "[]",
+            "egress_json": "",
+        }
+        base.update(overrides)
+        return base
+
+    return _factory
+
+
+def build_env_form(data):
+    """Construct a SandboxEnvironmentForm for the given POST data dict.
+    Creates a transient (unsaved) user so no DB state leaks between tests."""
+    from accounts.models import User as AccountsUser
+
+    username = f"_b5_{abs(hash(str(sorted(data.items()))))}"
+    email = f"{username}@test.invalid"
+    user, _ = AccountsUser.objects.get_or_create(username=username, defaults={"email": email})
+    return SandboxEnvironmentForm(data=data, user=user, is_admin=False)
+
+
 User = get_user_model()
 
 
@@ -125,7 +162,7 @@ def test_form_memory_value_and_unit_set_memory_bytes():
             "scope": Scope.USER,
             "memory_value": "1",
             "memory_unit": "GiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "env_vars_json": "[]",
         },
         user=user,
@@ -148,7 +185,7 @@ def test_form_empty_memory_value_maps_to_none():
             "scope": Scope.USER,
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "env_vars_json": "[]",
         },
         user=user,
@@ -160,10 +197,24 @@ def test_form_empty_memory_value_maps_to_none():
 
 
 @pytest.mark.django_db
-@pytest.mark.parametrize(("choice", "expected"), [("default", None), ("on", True), ("off", False)])
-def test_form_network_choice_maps_to_network_enabled(choice, expected):
+@pytest.mark.parametrize(
+    ("choice", "has_policy"),
+    [
+        ("off", False),
+        # "on" with allow-default stores a policy (network is on ⇒ egress_policy not None)
+        ("on", True),
+    ],
+)
+def test_form_network_choice_maps_to_egress_policy(choice, has_policy):
+    """network_choice="on" with allow-default ⇒ egress_policy stored; "off" ⇒ egress_policy=None."""
     from accounts.models import User
 
+    egress_json = ""
+    if choice == "on":
+        import json
+
+        egress_json = json.dumps({"default": "allow", "intercept": "all", "hosts": []})
+
     user = User.objects.create_user(username=f"n-{choice}", email=f"n-{choice}@e.com", password="x")  # noqa: S106
     form = SandboxEnvironmentForm(
         data={
@@ -173,6 +224,7 @@ def test_form_network_choice_maps_to_network_enabled(choice, expected):
             "memory_value": "",
             "memory_unit": "MiB",
             "network_choice": choice,
+            "egress_json": egress_json,
             "env_vars_json": "[]",
         },
         user=user,
@@ -180,7 +232,10 @@ def test_form_network_choice_maps_to_network_enabled(choice, expected):
     )
     assert form.is_valid(), form.errors
     env = form.save()
-    assert env.network_enabled is expected
+    if has_policy:
+        assert env.egress_policy is not None
+    else:
+        assert env.egress_policy is None
 
 
 @pytest.mark.django_db
@@ -188,8 +243,14 @@ def test_form_prefills_memory_and_network_from_instance():
     from accounts.models import User
 
     user = User.objects.create_user(username="p1", email="p1@e.com", password="x")  # noqa: S106
+    # An env with an egress_policy set ⇒ network is "on"
     env = SandboxEnvironment.objects.create(
-        scope=Scope.USER, user=user, name="dev", base_image="alpine", memory_bytes=2 * 2**30, network_enabled=True
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine",
+        memory_bytes=2 * 2**30,
+        egress_policy={"default": "allow", "intercept": "all", "rules": []},
     )
     form = SandboxEnvironmentForm(instance=env, user=user, is_admin=False)
     assert form.initial["memory_value"] == 2
@@ -202,13 +263,14 @@ def test_form_prefill_memory_in_mib_when_not_whole_gib():
     from accounts.models import User
 
     user = User.objects.create_user(username="p2", email="p2@e.com", password="x")  # noqa: S106
+    # No egress_policy ⇒ network is "off"
     env = SandboxEnvironment.objects.create(
-        scope=Scope.USER, user=user, name="dev", base_image="alpine", memory_bytes=512 * 2**20, network_enabled=None
+        scope=Scope.USER, user=user, name="dev", base_image="alpine", memory_bytes=512 * 2**20
     )
     form = SandboxEnvironmentForm(instance=env, user=user, is_admin=False)
     assert form.initial["memory_value"] == 512
     assert form.initial["memory_unit"] == "MiB"
-    assert form.initial["network_choice"] == "default"
+    assert form.initial["network_choice"] == "off"
 
 
 @pytest.mark.django_db
@@ -224,7 +286,7 @@ def test_form_rejects_custom_memory_mode_without_value():
             "memory_mode": "custom",
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "cpu_mode": "default",
             "env_vars_json": "[]",
         },
@@ -248,7 +310,7 @@ def test_form_rejects_custom_cpu_mode_without_value():
             "memory_mode": "default",
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "cpu_mode": "custom",
             "cpus": "",
             "env_vars_json": "[]",
@@ -268,7 +330,7 @@ def _post_data(self, **overrides):
             "description": "",
             "scope": "user",
             "base_image": "python:3.14",
-            "network_choice": "default",
+            "network_choice": "off",
             "memory_mode": "default",
             "cpu_mode": "default",
             "memory_unit": "MiB",
@@ -363,6 +425,408 @@ def test_form_repo_ids_json_initial_reflects_instance(user):
     assert json.loads(form.fields["repo_ids_json"].initial) == ["o/a", "o/b"]
 
 
+@pytest.mark.django_db
+def test_form_builds_egress_policy_and_secrets_from_hosts():
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue1", email="ue1@e.com", password="x")  # noqa: S106
+    egress = json.dumps({
+        "default": "deny",
+        # intercept is no longer user-configurable; even if submitted it is forced to "all".
+        "intercept": "credentialed",
+        "hosts": [
+            {
+                "host": "github.com",
+                "methods": ["*"],
+                "header": "",
+                "value": "",
+                "secret_name": "",
+                "has_existing_value": False,
+            },
+            {
+                "host": "api.openai.com",
+                "methods": ["GET", "post"],
+                "header": "Authorization",
+                "value": "sk-live",
+                "secret_name": "s_abc",
+                "has_existing_value": False,
+            },
+        ],
+    })
+    form = SandboxEnvironmentForm(
+        data={
+            "name": "dev",
+            "base_image": "alpine:latest",
+            "scope": Scope.USER,
+            "network_choice": "on",
+            "egress_json": egress,
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert form.is_valid(), form.errors
+    env = form.save()
+    assert env.egress_policy["default"] == "deny"
+    assert env.egress_policy["intercept"] == "all"  # always forced, regardless of submitted value
+    rules = env.egress_policy["rules"]
+    assert rules[0] == {"host": "github.com", "methods": ["*"], "inject": None}
+    assert rules[1]["host"] == "api.openai.com"
+    assert rules[1]["inject"] == "s_abc"
+    # methods are uppercased by the form normalisation layer (clean_egress_json)
+    assert rules[1]["methods"] == ["GET", "POST"]
+    assert env.egress_secrets == {"s_abc": {"header": "Authorization", "value": "sk-live"}}
+
+
+@pytest.mark.django_db
+def test_form_writes_no_policy_when_no_hosts():
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue2", email="ue2@e.com", password="x")  # noqa: S106
+    form = SandboxEnvironmentForm(
+        data={"name": "dev", "base_image": "alpine:latest", "scope": Scope.USER, "egress_json": ""},
+        user=user,
+        is_admin=False,
+    )
+    assert form.is_valid(), form.errors
+    env = form.save()
+    # An egress policy is an allow-list; with no allowed-host rules the form stores no policy
+    # (None) rather than a deny-all, so re-saving an env that never configured egress does not
+    # change its runtime network behavior.
+    assert env.egress_policy is None
+    assert env.egress_secrets == {}
+
+
+@pytest.mark.django_db
+def test_form_synthesises_secret_name_for_new_credentialed_host():
+    """A brand-new credentialed host with a blank ``secret_name`` (the common case:
+    add a host, type a header+value, never minting a name) must get a unique synthesised
+    ``inject`` wired to exactly one stored secret."""
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue4", email="ue4@e.com", password="x")  # noqa: S106
+    egress = json.dumps({
+        "default": "deny",
+        "intercept": "all",
+        "hosts": [
+            {
+                "host": "api.openai.com",
+                "methods": ["*"],
+                "header": "Authorization",
+                "value": "sk-live",
+                "secret_name": "",
+                "has_existing_value": False,
+            }
+        ],
+    })
+    form = SandboxEnvironmentForm(
+        data={
+            "name": "dev",
+            "base_image": "alpine:latest",
+            "scope": Scope.USER,
+            "network_choice": "on",
+            "egress_json": egress,
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert form.is_valid(), form.errors
+    env = form.save()
+    rules = env.egress_policy["rules"]
+    assert len(rules) == 1
+    inject = rules[0]["inject"]
+    assert inject and inject.startswith("s_")
+    assert set(env.egress_secrets) == {inject}
+    assert env.egress_secrets[inject] == {"header": "Authorization", "value": "sk-live"}
+
+
+@pytest.mark.django_db
+def test_form_rejects_invalid_credential_header():
+    """A credential header name carrying CR/LF (header-injection attempt) is rejected before it
+    can reach the sidecar."""
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue5", email="ue5@e.com", password="x")  # noqa: S106
+    form = SandboxEnvironmentForm(
+        data={
+            "name": "d",
+            "base_image": "alpine",
+            "scope": Scope.USER,
+            "egress_json": json.dumps({
+                "default": "deny",
+                "intercept": "all",
+                "hosts": [
+                    {
+                        "host": "api.openai.com",
+                        "methods": ["*"],
+                        "header": "Authorization\r\nX-Evil",
+                        "value": "sk-live",
+                        "secret_name": "",
+                        "has_existing_value": False,
+                    }
+                ],
+            }),
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert not form.is_valid()
+    assert "egress_json" in form.errors
+
+
+@pytest.mark.django_db
+def test_form_rejects_bad_egress_enums_and_blank_host():
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue3", email="ue3@e.com", password="x")  # noqa: S106
+    bad_default = SandboxEnvironmentForm(
+        data={
+            "name": "d",
+            "base_image": "alpine",
+            "scope": Scope.USER,
+            "egress_json": json.dumps({"default": "nope", "intercept": "all", "hosts": []}),
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert not bad_default.is_valid()
+    assert "egress_json" in bad_default.errors
+
+    blank_host = SandboxEnvironmentForm(
+        data={
+            "name": "d",
+            "base_image": "alpine",
+            "scope": Scope.USER,
+            "egress_json": json.dumps({
+                "default": "deny",
+                "intercept": "all",
+                "hosts": [{"host": "  ", "methods": ["*"]}],
+            }),
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert not blank_host.is_valid()
+    assert "egress_json" in blank_host.errors
+
+
+@pytest.mark.django_db
+def test_egress_initial_masks_secret_values():
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue4", email="ue4@e.com", password="x")  # noqa: S106
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine:latest",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "sk-secret"}},
+    )
+    form = SandboxEnvironmentForm(instance=env, user=user, is_admin=False)
+    state = json.loads(form.fields["egress_json"].initial)
+    host = state["hosts"][0]
+    assert host["host"] == "api.openai.com"
+    assert host["secret_name"] == "s1"  # noqa: S105
+    assert host["header"] == "Authorization"
+    assert host["value"] == ""  # masked — never leaks plaintext
+    assert host["has_existing_value"] is True
+    assert "sk-secret" not in form.fields["egress_json"].initial
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("masked_value", ["", "******"])
+def test_egress_preserves_unchanged_secret_on_edit(masked_value):
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue5", email="ue5@e.com", password="x")  # noqa: S106
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine:latest",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "sk-secret"}},
+    )
+    submitted = json.dumps({
+        "default": "deny",
+        "intercept": "all",
+        "hosts": [
+            {
+                "host": "api.openai.com",
+                "methods": ["*"],
+                "header": "Authorization",
+                "value": masked_value,
+                "secret_name": "s1",
+                "has_existing_value": True,
+            }
+        ],
+    })
+    form = SandboxEnvironmentForm(
+        instance=env,
+        data={
+            "name": "dev",
+            "base_image": "alpine:latest",
+            "scope": Scope.USER,
+            "network_choice": "on",
+            "egress_json": submitted,
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert form.is_valid(), form.errors
+    saved = form.save()
+    assert saved.egress_secrets == {"s1": {"header": "Authorization", "value": "sk-secret"}}
+
+
+@pytest.mark.django_db
+def test_egress_changed_secret_overwrites_on_edit():
+    from accounts.models import User
+
+    user = User.objects.create_user(username="ue6", email="ue6@e.com", password="x")  # noqa: S106
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine:latest",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "old"}},
+    )
+    submitted = json.dumps({
+        "default": "deny",
+        "intercept": "all",
+        "hosts": [
+            {
+                "host": "api.openai.com",
+                "methods": ["*"],
+                "header": "Authorization",
+                "value": "new",
+                "secret_name": "s1",
+                "has_existing_value": True,
+            }
+        ],
+    })
+    form = SandboxEnvironmentForm(
+        instance=env,
+        data={
+            "name": "dev",
+            "base_image": "alpine:latest",
+            "scope": Scope.USER,
+            "network_choice": "on",
+            "egress_json": submitted,
+        },
+        user=user,
+        is_admin=False,
+    )
+    assert form.is_valid(), form.errors
+    saved = form.save()
+    assert saved.egress_secrets["s1"]["value"] == "new"
+
+
+@pytest.mark.django_db
+def test_egress_initial_returns_empty_credentials_on_decryption_error(user, mocker, caplog):
+    """Exercises the swallow branch of ``_initial_egress_json``: when the
+    ``egress_secrets`` getter raises ``DecryptionError``, the editor must still
+    render the policy (host/methods) but with empty credentials, never raising."""
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "sk-secret"}},
+    )
+    from core.encryption import DecryptionError
+
+    # Patch the descriptor: when accessed on the instance, raise DecryptionError.
+    def _raise(instance):
+        raise DecryptionError("bad key")
+
+    mocker.patch.object(type(env), "egress_secrets", new_callable=lambda: property(fget=_raise))
+    caplog.set_level(logging.ERROR, logger="daiv.sandbox_envs")
+    form = SandboxEnvironmentForm(instance=env, user=user, is_admin=False)
+    state = json.loads(form.fields["egress_json"].initial)
+    host = state["hosts"][0]
+    assert host["host"] == "api.openai.com"
+    assert host["methods"] == ["*"]
+    assert host["header"] == ""
+    assert host["value"] == ""
+    assert host["has_existing_value"] is False
+    assert "decryption failed" in caplog.text
+
+
+@pytest.mark.django_db
+def test_egress_refuses_when_existing_secrets_cannot_be_decrypted(user, mocker):
+    """Exercises the RAISE branch of ``_preserve_unchanged_egress_secrets``: a
+    masked edit over unreadable ciphertext must refuse to persist rather than
+    silently overwrite the still-valid secret with the mask."""
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine:latest",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "sk-secret"}},
+    )
+    original_ciphertext = SandboxEnvironment.objects.get(pk=env.pk)._egress_secrets_encrypted
+    from core.encryption import DecryptionError
+
+    # Patch the descriptor: when accessed on the instance, raise DecryptionError.
+    def _raise(instance):
+        raise DecryptionError("bad key")
+
+    mocker.patch.object(type(env), "egress_secrets", new_callable=lambda: property(fget=_raise))
+    submitted = json.dumps({
+        "default": "deny",
+        "intercept": "all",
+        "hosts": [
+            {
+                "host": "api.openai.com",
+                "methods": ["*"],
+                "header": "Authorization",
+                "value": "",
+                "secret_name": "s1",
+                "has_existing_value": True,
+            }
+        ],
+    })
+    form = SandboxEnvironmentForm(
+        instance=env,
+        data={"name": "dev", "base_image": "alpine:latest", "scope": Scope.USER, "egress_json": submitted},
+        user=user,
+        is_admin=False,
+    )
+    # Validation guard: model-level _validate_egress also catches the unreadable
+    # ciphertext during _post_clean, so the form never reports as valid and the
+    # original ciphertext is left untouched.
+    assert form.is_valid() is False
+    env.refresh_from_db()
+    assert env._egress_secrets_encrypted == original_ciphertext
+    # Form-helper guard (defense in depth): _preserve_unchanged_egress_secrets raises
+    # rather than letting a masked value overwrite the undecryptable stored secret.
+    with pytest.raises(ValidationError):
+        SandboxEnvironmentForm._preserve_unchanged_egress_secrets(env, {"s1": {"header": "Authorization", "value": ""}})
+
+
 @pytest.mark.django_db
 def test_form_env_vars_json_initial_returns_empty_on_decryption_error(user, mocker, caplog):
     env = SandboxEnvironment.objects.create(
@@ -383,3 +847,52 @@ def _raise(instance):
     form = SandboxEnvironmentForm(instance=env, user=user, is_admin=False)
     assert form.fields["env_vars_json"].initial == "[]"
     assert "decryption failed" in caplog.text
+
+
+# ---------------------------------------------------------------------------
+# B5 tests: On/Off network toggle, "On must permit something", allow-all storage
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.django_db
+def test_on_with_no_rules_and_deny_default_is_rejected(make_form_data):
+    data = make_form_data(
+        network_choice="on", egress_json=json.dumps({"default": "deny", "intercept": "all", "hosts": []})
+    )
+    form = build_env_form(data)
+    assert not form.is_valid()
+    assert "network_choice" in form.errors
+
+
+@pytest.mark.django_db
+def test_on_allow_all_stores_policy(make_form_data):
+    data = make_form_data(
+        network_choice="on", egress_json=json.dumps({"default": "allow", "intercept": "all", "hosts": []})
+    )
+    form = build_env_form(data)
+    assert form.is_valid(), form.errors
+    assert form.cleaned_data["egress_policy"] == {"default": "allow", "intercept": "all", "rules": []}
+
+
+@pytest.mark.django_db
+def test_off_forces_null_policy_even_with_hosts(make_form_data):
+    data = make_form_data(
+        network_choice="off",
+        egress_json=json.dumps({
+            "default": "deny",
+            "intercept": "all",
+            "hosts": [
+                {
+                    "host": "github.com",
+                    "methods": ["*"],
+                    "header": "",
+                    "value": "",
+                    "secret_name": "",
+                    "has_existing_value": False,
+                }
+            ],
+        }),
+    )
+    form = build_env_form(data)
+    assert form.is_valid(), form.errors
+    assert form.cleaned_data["egress_policy"] is None
diff --git a/tests/unit_tests/sandbox_envs/test_migrations.py b/tests/unit_tests/sandbox_envs/test_migrations.py
new file mode 100644
index 000000000..d8aa9b981
--- /dev/null
+++ b/tests/unit_tests/sandbox_envs/test_migrations.py
@@ -0,0 +1,50 @@
+"""Migration test for 0006_drop_network_enabled.
+
+Uses Django's built-in ``MigrationExecutor`` (no ``django-test-migrations``
+dependency required). The test migrates to 0005, seeds two rows via the
+historical model, then migrates to 0006 and asserts the data op ran correctly:
+
+- An env that was ``network_enabled=False`` with a non-null egress_policy has
+  its egress_policy NULLed (the "off" intent is preserved).
+- An env that was ``network_enabled=True`` with a non-null egress_policy keeps
+  its egress_policy intact.
+"""
+
+from django.db import connection
+from django.db.migrations.executor import MigrationExecutor
+
+import pytest
+
+
+@pytest.mark.django_db(transaction=True)
+def test_off_env_with_policy_loses_policy():
+    """null_egress_for_off_envs: network-off env's policy is nulled; network-on env's policy is kept."""
+    executor = MigrationExecutor(connection)
+
+    # Migrate down to 0005 so we have the historical model with network_enabled.
+    executor.migrate([("sandbox_envs", "0005_sandboxenvironment__egress_secrets_encrypted_and_more")])
+    executor.loader.build_graph()
+
+    old_state = executor.loader.project_state((
+        "sandbox_envs",
+        "0005_sandboxenvironment__egress_secrets_encrypted_and_more",
+    ))
+    env_model_old = old_state.apps.get_model("sandbox_envs", "SandboxEnvironment")
+
+    policy = {"default": "allow", "rules": []}
+
+    off = env_model_old.objects.create(
+        scope="global", name="off-with-policy", network_enabled=False, egress_policy=policy
+    )
+    on = env_model_old.objects.create(scope="global", name="on-with-policy", network_enabled=True, egress_policy=policy)
+
+    # Migrate to 0006 (applies data op then drops network_enabled).
+    executor2 = MigrationExecutor(connection)
+    executor2.migrate([("sandbox_envs", "0006_drop_network_enabled")])
+    executor2.loader.build_graph()
+
+    new_state = executor2.loader.project_state(("sandbox_envs", "0006_drop_network_enabled"))
+    env_model_new = new_state.apps.get_model("sandbox_envs", "SandboxEnvironment")
+
+    assert env_model_new.objects.get(pk=off.pk).egress_policy is None, "off env: egress_policy should be nulled"
+    assert env_model_new.objects.get(pk=on.pk).egress_policy is not None, "on env: egress_policy should be preserved"
diff --git a/tests/unit_tests/sandbox_envs/test_models.py b/tests/unit_tests/sandbox_envs/test_models.py
index f43908422..96c659b5b 100644
--- a/tests/unit_tests/sandbox_envs/test_models.py
+++ b/tests/unit_tests/sandbox_envs/test_models.py
@@ -315,7 +315,7 @@ def test_summary_returns_all_segments_joined(user):
         base_image="rust:1.83",
         cpus=Decimal("2"),
         memory_bytes=4 * 2**30,
-        network_enabled=True,
+        egress_policy={"default": "allow", "intercept": "all", "rules": []},
     )
     assert env.summary == "rust:1.83 · 2 CPU · 4 GiB · net"
 
@@ -328,11 +328,17 @@ def test_summary_omits_missing_segments(user):
 
 @pytest.mark.django_db
 def test_summary_includes_network_only_when_explicitly_enabled(user):
+    # No egress_policy ⇒ network off ⇒ no "net" segment
     env_off = SandboxEnvironment.objects.create(
-        scope=Scope.USER, user=user, name="off", base_image="alpine", network_enabled=False
+        scope=Scope.USER, user=user, name="off", base_image="alpine", egress_policy=None
     )
+    # egress_policy set ⇒ network on ⇒ "net" segment present
     env_on = SandboxEnvironment.objects.create(
-        scope=Scope.USER, user=user, name="on", base_image="alpine", network_enabled=True
+        scope=Scope.USER,
+        user=user,
+        name="on",
+        base_image="alpine",
+        egress_policy={"default": "allow", "intercept": "all", "rules": []},
     )
     assert "net" not in env_off.summary
     assert "net" in env_on.summary
@@ -347,15 +353,16 @@ def test_short_summary_joins_base_image_and_net(user):
         base_image="rust:1.83",
         cpus=Decimal("2"),
         memory_bytes=4 * 2**30,
-        network_enabled=True,
+        egress_policy={"default": "allow", "intercept": "all", "rules": []},
     )
     assert env.short_summary == "rust:1.83 · net"
 
 
 @pytest.mark.django_db
 def test_short_summary_omits_net_when_disabled(user):
+    # No egress_policy ⇒ network off ⇒ short_summary has no "net" segment
     env = SandboxEnvironment.objects.create(
-        scope=Scope.USER, user=user, name="dev", base_image="alpine:3.20", network_enabled=False
+        scope=Scope.USER, user=user, name="dev", base_image="alpine:3.20", egress_policy=None
     )
     assert env.short_summary == "alpine:3.20"
 
@@ -402,3 +409,130 @@ def test_can_delete_allows_user_env(user):
 def test_can_delete_allows_non_default_global(_clear_global_envs):
     env = SandboxEnvironment.objects.create(scope=Scope.GLOBAL, name="g", base_image="g", is_default=False)
     assert env.can_delete() == (True, None)
+
+
+def _egress_env(**over):
+    """Unsaved GLOBAL env carrying an egress config, for clean()/validator unit tests."""
+    base = {
+        "scope": Scope.GLOBAL,
+        "name": "egress",
+        "base_image": "python:3.12",
+        "egress_policy": {
+            "default": "deny",
+            "intercept": "credentialed",
+            "rules": [{"host": "*.github.com", "methods": ["GET"], "inject": "gh"}],
+        },
+        "egress_secrets": {"gh": {"header": "Authorization", "value": "Bearer t"}},
+    }
+    base.update(over)
+    return SandboxEnvironment(**base)
+
+
+def test_validate_egress_accepts_valid_config():
+    _egress_env()._validate_egress()  # must not raise
+
+
+def test_validate_egress_rejects_dangling_inject():
+    from django.core.exceptions import ValidationError
+
+    env = _egress_env(egress_secrets={})  # rule injects "gh" but no such secret
+    with pytest.raises(ValidationError):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_bad_default():
+    from django.core.exceptions import ValidationError
+
+    env = _egress_env(egress_policy={"default": "sometimes", "intercept": "all", "rules": []})
+    with pytest.raises(ValidationError):
+        env._validate_egress()
+
+
+def test_egress_secrets_encrypted_at_rest():
+    env = _egress_env()
+    assert env._egress_secrets_encrypted  # ciphertext populated by the descriptor
+    assert "Bearer t" not in env._egress_secrets_encrypted
+
+
+def test_validate_egress_rejects_too_many_rules():
+    from django.core.exceptions import ValidationError
+
+    from sandbox_envs.models import EGRESS_MAX_RULES
+
+    rules = [{"host": f"h{i}.example"} for i in range(EGRESS_MAX_RULES + 1)]
+    env = _egress_env(egress_policy={"default": "deny", "intercept": "all", "rules": rules}, egress_secrets={})
+    with pytest.raises(ValidationError, match="Too many egress rules"):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_too_many_secrets():
+    from django.core.exceptions import ValidationError
+
+    from sandbox_envs.models import EGRESS_MAX_SECRETS
+
+    secrets = {f"s{i}": {"header": "Authorization", "value": "v"} for i in range(EGRESS_MAX_SECRETS + 1)}
+    env = _egress_env(egress_policy={"default": "deny", "intercept": "all", "rules": []}, egress_secrets=secrets)
+    with pytest.raises(ValidationError, match="Too many egress secrets"):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_non_dict_policy():
+    """A hand-edited/drifted row whose egress_policy is not an object is rejected (defence-in-depth:
+    the form always produces a dict, but a tampered row must not reach from_stored)."""
+    from django.core.exceptions import ValidationError
+
+    env = _egress_env(egress_policy=["not", "a", "dict"], egress_secrets={})
+    with pytest.raises(ValidationError, match="must be an object"):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_non_dict_secrets():
+    """Decrypted egress_secrets that is not an object is rejected before from_stored iterates it."""
+    from django.core.exceptions import ValidationError
+
+    env = _egress_env(egress_policy={"default": "deny", "intercept": "all", "rules": []}, egress_secrets=["nope"])
+    with pytest.raises(ValidationError, match="must be an object"):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_oversized_secrets_blob():
+    """The encrypted secrets blob is capped at 32 KiB to bound payload size reaching the sidecar."""
+    from django.core.exceptions import ValidationError
+
+    env = _egress_env(
+        egress_policy={"default": "deny", "intercept": "all", "rules": []},
+        egress_secrets={"big": {"header": "Authorization", "value": "x" * 40000}},
+    )
+    with pytest.raises(ValidationError, match="32 KiB"):
+        env._validate_egress()
+
+
+def test_validate_egress_rejects_reserved_platform_secret_name():
+    """A user-defined egress secret named ``__daiv_git_platform__`` (or a rule injecting it) must be
+    rejected at save time: ``apply_platform_egress`` overwrites that key at runtime, so allowing it in
+    stored config would let a user silently shadow DAIV's authenticated git-platform credential."""
+    from django.core.exceptions import ValidationError
+
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME
+
+    env = _egress_env(
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "example.com", "methods": ["GET"], "inject": PLATFORM_EGRESS_SECRET_NAME}],
+        },
+        egress_secrets={PLATFORM_EGRESS_SECRET_NAME: {"header": "Authorization", "value": "Bearer t"}},
+    )
+    with pytest.raises(ValidationError, match="reserved"):
+        env._validate_egress()
+
+
+@pytest.mark.django_db
+def test_summary_marks_net_when_egress_policy_present():
+    on = SandboxEnvironment(
+        scope=Scope.GLOBAL, name="on", base_image="python:3.14", egress_policy={"default": "allow", "rules": []}
+    )
+    off = SandboxEnvironment(scope=Scope.GLOBAL, name="off", base_image="python:3.14", egress_policy=None)
+    assert "net" in on.summary and "net" in on.short_summary
+    assert "net" not in off.summary and "net" not in off.short_summary
+    assert not hasattr(off, "network_enabled")
diff --git a/tests/unit_tests/sandbox_envs/test_services.py b/tests/unit_tests/sandbox_envs/test_services.py
index 7e91e6e5f..1bf19f3bc 100644
--- a/tests/unit_tests/sandbox_envs/test_services.py
+++ b/tests/unit_tests/sandbox_envs/test_services.py
@@ -7,6 +7,175 @@
 from accounts.models import User
 
 
+def _sandbox_runtime(*, base_image="python:3.12", egress=None):
+    from codebase.context import SandboxRuntime
+    from core.sandbox.command_policy import SandboxCommandPolicy
+
+    return SandboxRuntime(
+        base_image=base_image,
+        memory_bytes=None,
+        cpus=None,
+        env_vars={},
+        command_policy=SandboxCommandPolicy(),
+        egress=egress,
+    )
+
+
+def test_augment_opens_network_off_env_when_push_credentialed():
+    from unittest.mock import Mock
+
+    from pydantic import SecretStr
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME, augment_sandbox_with_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+
+    # DAIV pushes from inside the sandbox, so a network-off env (egress=None) that holds a real push
+    # credential is opened into a minimal deny-all + git-platform triad rather than left isolated.
+    sb = _sandbox_runtime(egress=None)
+    client = Mock()
+    client.get_git_egress_credential.return_value = GitEgressCredential(
+        host="gitlab.example.com", value=SecretStr("Basic abc")
+    )
+    out = augment_sandbox_with_platform_egress(sb, client, Mock())
+
+    assert out.egress is not None
+    assert out.egress.policy.default == "deny"
+    assert out.egress.policy.rules[0].host == "gitlab.example.com"
+    assert PLATFORM_EGRESS_SECRET_NAME in out.egress.secrets
+
+
+def test_augment_keeps_network_off_isolated_without_push_token():
+    from unittest.mock import Mock
+
+    from sandbox_envs.services import augment_sandbox_with_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+
+    # A host-only credential (no token, e.g. the SWE eval platform) has nothing to push, so a
+    # network-off env stays fully isolated — never forcing the egress proxy onto token-less runs.
+    sb = _sandbox_runtime(egress=None)
+    client = Mock()
+    client.get_git_egress_credential.return_value = GitEgressCredential(host="github.com", value=None)
+    out = augment_sandbox_with_platform_egress(sb, client, Mock())
+    assert out is sb
+
+
+def test_augment_keeps_network_off_isolated_without_credential():
+    from unittest.mock import Mock
+
+    from sandbox_envs.services import augment_sandbox_with_platform_egress
+
+    # No derivable credential (degenerate clone URL) on a network-off env: stay isolated.
+    sb = _sandbox_runtime(egress=None)
+    client = Mock()
+    client.get_git_egress_credential.return_value = None
+    out = augment_sandbox_with_platform_egress(sb, client, Mock())
+    assert out is sb
+
+
+def test_augment_skips_when_sandbox_disabled():
+    from unittest.mock import Mock
+
+    from sandbox_envs.services import augment_sandbox_with_platform_egress
+
+    from core.sandbox.schemas import EgressConfigRequest
+
+    # Networked (egress set) but sandbox disabled (base_image=None → enabled == False): still a skip.
+    sb = _sandbox_runtime(base_image=None, egress=EgressConfigRequest())
+    client = Mock()
+    out = augment_sandbox_with_platform_egress(sb, client, Mock())
+    assert out is sb
+    client.get_git_egress_credential.assert_not_called()
+
+
+def test_augment_adds_platform_egress_when_network_on():
+    from unittest.mock import Mock
+
+    from pydantic import SecretStr
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME, augment_sandbox_with_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+    from core.sandbox.schemas import EgressConfigRequest
+
+    sb = _sandbox_runtime(egress=EgressConfigRequest())
+    client = Mock()
+    client.get_git_egress_credential.return_value = GitEgressCredential(
+        host="gitlab.example.com", value=SecretStr("Basic abc")
+    )
+    repo = Mock()
+
+    out = augment_sandbox_with_platform_egress(sb, client, repo)
+
+    client.get_git_egress_credential.assert_called_once_with(repo)
+    assert out.egress.policy.rules[0].host == "gitlab.example.com"
+    assert PLATFORM_EGRESS_SECRET_NAME in out.egress.secrets
+
+
+def test_apply_platform_egress_returns_unchanged_when_no_credential():
+    from sandbox_envs.services import apply_platform_egress
+
+    from core.sandbox.schemas import EgressConfigRequest
+
+    egress = EgressConfigRequest()
+    assert apply_platform_egress(egress, None) is egress
+
+
+def test_apply_platform_egress_builds_deny_all_base_and_injects():
+    from pydantic import SecretStr
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME, apply_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+
+    cred = GitEgressCredential(host="gitlab.example.com", value=SecretStr("Basic abc"))
+    result = apply_platform_egress(None, cred)
+
+    assert result.policy.default == "deny"
+    assert result.policy.intercept == "all"
+    rule = result.policy.rules[0]
+    assert rule.host == "gitlab.example.com"
+    assert rule.methods == ["*"]
+    assert rule.inject == PLATFORM_EGRESS_SECRET_NAME
+    secret = result.secrets[PLATFORM_EGRESS_SECRET_NAME]
+    assert secret.header == "Authorization"
+    assert secret.value.get_secret_value() == "Basic abc"
+
+
+def test_apply_platform_egress_preserves_env_policy_and_prepends():
+    from pydantic import SecretStr
+    from sandbox_envs.services import apply_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+    from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+    env = EgressConfigRequest(
+        policy=EgressPolicy(
+            default="deny",
+            intercept="credentialed",
+            rules=[EgressRule(host="api.openai.com", methods=["GET"], inject="s1")],
+        ),
+        secrets={"s1": EgressSecret(header="Authorization", value=SecretStr("sk"))},
+    )
+    cred = GitEgressCredential(host="github.com", value=SecretStr("Basic xyz"))
+    result = apply_platform_egress(env, cred)
+
+    assert result.policy.intercept == "credentialed"  # env knob preserved
+    assert [r.host for r in result.policy.rules] == ["github.com", "api.openai.com"]  # prepended
+    assert set(result.secrets) == {"s1", "__daiv_git_platform__"}
+
+
+def test_apply_platform_egress_reachability_only_when_no_token():
+    from sandbox_envs.services import PLATFORM_EGRESS_SECRET_NAME, apply_platform_egress
+
+    from codebase.clients.base import GitEgressCredential
+
+    cred = GitEgressCredential(host="gitlab.example.com", value=None)
+    result = apply_platform_egress(None, cred)
+
+    assert result.policy.rules[0].host == "gitlab.example.com"
+    assert result.policy.rules[0].inject is None
+    assert PLATFORM_EGRESS_SECRET_NAME not in result.secrets
+
+
 @pytest.mark.asyncio
 async def test_resolve_returns_none_for_none_id():
     assert await resolve_sandbox_env(None) is None
@@ -83,7 +252,6 @@ def test_humanise_global_default_with_full_row():
         scope=Scope.GLOBAL,
         name="Default",
         base_image="python:3.14",
-        network_enabled=True,
         memory_bytes=2 * 2**30,
         cpus=Decimal("1.5"),
         is_default=True,
@@ -91,14 +259,7 @@ def test_humanise_global_default_with_full_row():
     from sandbox_envs.services import humanise_global_default
 
     summary = humanise_global_default()
-    assert summary == {
-        "network": "enabled",
-        "memory": "2 GiB",
-        "cpus": "1.5",
-        "has_network": True,
-        "has_memory": True,
-        "has_cpus": True,
-    }
+    assert summary == {"memory": "2 GiB", "cpus": "1.5", "has_memory": True, "has_cpus": True}
 
 
 @pytest.mark.django_db(transaction=True)
@@ -107,14 +268,7 @@ def test_humanise_global_default_empty_returns_none_marks():
     from sandbox_envs.services import humanise_global_default
 
     summary = humanise_global_default()
-    assert summary == {
-        "network": "",
-        "memory": "",
-        "cpus": "",
-        "has_network": False,
-        "has_memory": False,
-        "has_cpus": False,
-    }
+    assert summary == {"memory": "", "cpus": "", "has_memory": False, "has_cpus": False}
 
 
 @pytest.mark.django_db(transaction=True)
@@ -239,7 +393,8 @@ def test_anonymous_user_uses_global_only(self):
 
 @pytest.mark.django_db
 def test_get_global_default_returns_row_values_without_overlay():
-    """After the env-lock removal, get_global_default just reads the row."""
+    """After the env-lock removal, get_global_default just reads the row.
+    Network state is now derived from egress_policy presence, not a separate column."""
     from asgiref.sync import async_to_sync
     from sandbox_envs.services import get_global_default
 
@@ -250,7 +405,7 @@ def test_get_global_default_returns_row_values_without_overlay():
         base_image="python:3.14",
         cpus=2.0,
         memory_bytes=2 * 2**30,
-        network_enabled=True,
+        egress_policy={"default": "allow", "intercept": "all", "rules": []},
         is_default=True,
     )
 
@@ -259,7 +414,8 @@ def test_get_global_default_returns_row_values_without_overlay():
     assert override.base_image == "python:3.14"
     assert override.cpus == 2.0
     assert override.memory_bytes == 2 * 2**30
-    assert override.network_enabled is True
+    # egress_policy is set ⇒ egress is populated (network is on)
+    assert override.egress is not None
 
 
 def test_get_locked_runtime_fields_is_gone():
@@ -288,33 +444,49 @@ def test_site_settings_has_no_sandbox_resource_fields():
 @pytest.mark.django_db
 class TestMergeSandboxRuntime:
     def test_per_run_env_supplies_fields_when_set(self):
+        from pydantic import SecretStr
         from sandbox_envs.services import SandboxEnvOverride, merge_sandbox_runtime
 
+        from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+        egress_on = EgressConfigRequest(
+            policy=EgressPolicy(rules=[EgressRule(host="per-run.example", inject="t")]),
+            secrets={"t": EgressSecret(header="Authorization", value=SecretStr("Bearer x"))},
+        )
         per_run = SandboxEnvOverride(
-            base_image="python:3.14", network_enabled=True, memory_bytes=2 * 2**30, cpus=2.0, env_vars={"K": "v"}
+            base_image="python:3.14", memory_bytes=2 * 2**30, cpus=2.0, env_vars={"K": "v"}, egress=egress_on
         )
         global_default = SandboxEnvOverride(
-            base_image="python:3.12", network_enabled=False, memory_bytes=1 * 2**30, cpus=1.0, env_vars={"G": "g"}
+            base_image="python:3.12", memory_bytes=1 * 2**30, cpus=1.0, env_vars={"G": "g"}, egress=None
         )
         runtime = merge_sandbox_runtime(per_run=per_run, global_default=global_default)
         assert runtime.base_image == "python:3.14"
-        assert runtime.network_enabled is True
+        # per-run egress takes precedence; network is on (egress is not None)
+        assert runtime.egress is not None
+        assert runtime.egress.policy.rules[0].host == "per-run.example"
         assert runtime.memory_bytes == 2 * 2**30
         assert runtime.cpus == 2.0
         assert runtime.env_vars == {"G": "g", "K": "v"}
 
-    def test_falls_through_to_global_default(self):
+    def test_per_run_off_blocks_global_egress_inheritance(self):
+        from pydantic import SecretStr
         from sandbox_envs.services import SandboxEnvOverride, merge_sandbox_runtime
 
-        per_run = SandboxEnvOverride(
-            base_image=None, network_enabled=None, memory_bytes=None, cpus=None, env_vars={"K": "v"}
+        from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+        egress_global = EgressConfigRequest(
+            policy=EgressPolicy(rules=[EgressRule(host="global.example", inject="t")]),
+            secrets={"t": EgressSecret(header="Authorization", value=SecretStr("Bearer x"))},
         )
+        per_run = SandboxEnvOverride(base_image=None, memory_bytes=None, cpus=None, env_vars={"K": "v"}, egress=None)
         global_default = SandboxEnvOverride(
-            base_image="python:3.12", network_enabled=False, memory_bytes=1 * 2**30, cpus=1.0, env_vars={"G": "g"}
+            base_image="python:3.12", memory_bytes=1 * 2**30, cpus=1.0, env_vars={"G": "g"}, egress=egress_global
         )
         runtime = merge_sandbox_runtime(per_run=per_run, global_default=global_default)
         assert runtime.base_image == "python:3.12"
-        assert runtime.network_enabled is False
+        # per-run has no egress (off); global_default's egress is NOT inherited
+        # (network is per-env, not fallthrough — per-run off beats global on)
+        assert runtime.egress is None
         assert runtime.memory_bytes == 1 * 2**30
         assert runtime.cpus == 1.0
         assert runtime.env_vars == {"G": "g", "K": "v"}
@@ -323,15 +495,10 @@ def test_per_run_env_vars_shadow_global_on_key_collision(self):
         from sandbox_envs.services import SandboxEnvOverride, merge_sandbox_runtime
 
         per_run = SandboxEnvOverride(
-            base_image=None,
-            network_enabled=None,
-            memory_bytes=None,
-            cpus=None,
-            env_vars={"SHARED": "from-per-run", "PER_RUN_ONLY": "x"},
+            base_image=None, memory_bytes=None, cpus=None, env_vars={"SHARED": "from-per-run", "PER_RUN_ONLY": "x"}
         )
         global_default = SandboxEnvOverride(
             base_image="python:3.12",
-            network_enabled=False,
             memory_bytes=None,
             cpus=None,
             env_vars={"SHARED": "from-global", "GLOBAL_ONLY": "g"},
@@ -344,9 +511,7 @@ def test_command_policy_defaults_empty(self):
 
         from core.sandbox.command_policy import SandboxCommandPolicy
 
-        per_run = SandboxEnvOverride(
-            base_image="python:3.14", network_enabled=False, memory_bytes=None, cpus=None, env_vars={}
-        )
+        per_run = SandboxEnvOverride(base_image="python:3.14", memory_bytes=None, cpus=None, env_vars={})
         runtime = merge_sandbox_runtime(per_run=per_run, global_default=None)
         assert runtime.command_policy == SandboxCommandPolicy()
 
@@ -489,3 +654,206 @@ def test_build_env_trigger_updated_uses_action_key(global_env):
 
 def test_build_env_trigger_deleted_uses_action_key(global_env):
     assert "env-deleted" in build_env_trigger(global_env, "deleted")
+
+
+def _egress_request(host: str):
+    from pydantic import SecretStr
+
+    from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+    return EgressConfigRequest(
+        policy=EgressPolicy(rules=[EgressRule(host=host, inject="t")]),
+        secrets={"t": EgressSecret(header="Authorization", value=SecretStr("Bearer x"))},
+    )
+
+
+# _override was the old scaffolding helper (used network_enabled); replaced by _ov defined below.
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db(transaction=True)
+async def test_row_to_override_builds_egress():
+    from sandbox_envs.services import row_to_override
+
+    env = await SandboxEnvironment.objects.acreate(
+        scope=Scope.GLOBAL,
+        name="eg",
+        base_image="python:3.12",
+        egress_policy={
+            "default": "deny",
+            "intercept": "credentialed",
+            "rules": [{"host": "*.github.com", "methods": ["GET"], "inject": "gh"}],
+        },
+        egress_secrets={"gh": {"header": "Authorization", "value": "Bearer t"}},
+    )
+    override = row_to_override(env)
+    assert override.egress is not None
+    assert override.egress.policy.rules[0].host == "*.github.com"
+    assert override.egress.secrets["gh"].value.get_secret_value() == "Bearer t"
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db(transaction=True)
+async def test_row_to_override_fails_closed_to_none_when_malformed():
+    from sandbox_envs.services import row_to_override
+
+    # Dangling inject (no matching secret) — stored directly, bypassing clean(). The env intended
+    # restricted egress but its config is unusable; fail closed to NO network (egress=None →
+    # network_mode=none). The old deny-all-with-plumbing state no longer exists and would be rejected
+    # by the sandbox (422 "permits nothing").
+    env = await SandboxEnvironment.objects.acreate(
+        scope=Scope.GLOBAL,
+        name="bad",
+        base_image="python:3.12",
+        egress_policy={"default": "deny", "rules": [{"host": "x", "inject": "missing"}]},
+        egress_secrets={},
+    )
+    override = row_to_override(env)
+    assert override.egress is None
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db(transaction=True)
+async def test_row_to_override_fails_closed_to_none_on_decryption_error(mocker):
+    from sandbox_envs.services import row_to_override
+
+    from core.encryption import DecryptionError
+
+    env = await SandboxEnvironment.objects.acreate(
+        scope=Scope.GLOBAL,
+        name="rotated",
+        base_image="python:3.12",
+        egress_policy={"default": "deny", "rules": [{"host": "*.github.com", "inject": "gh"}]},
+        egress_secrets={"gh": {"header": "Authorization", "value": "Bearer t"}},
+    )
+
+    # Simulate a rotated/lost DAIV_ENCRYPTION_KEY: the still-present egress_policy can no longer be
+    # paired with its decryptable secrets. The env intended restricted egress but its config is unusable;
+    # fail closed to NO network (egress=None → network_mode=none). The old deny-all-with-plumbing state
+    # no longer exists and would be rejected by the sandbox.
+    def _raise(instance):
+        raise DecryptionError("bad key")
+
+    mocker.patch.object(type(env), "egress_secrets", new_callable=lambda: property(fget=_raise))
+    override = row_to_override(env)
+    assert override.egress is None
+
+
+def test_row_to_override_fails_closed_to_none_no_db():
+    """Non-DB guard: dangling inject triggers the except branch → egress=None, no network."""
+    from types import SimpleNamespace
+
+    from sandbox_envs.services import row_to_override
+
+    # Build an unsaved mock that provides exactly the attributes row_to_override reads (including the
+    # derived `is_networked`, which a real model computes from egress_policy). egress_policy has a
+    # dangling inject ("missing" is not in egress_secrets={}) so EgressConfigRequest.from_stored
+    # raises, hitting the fail-closed except branch.
+    env = SimpleNamespace(
+        id="test-no-db",
+        name="no-db",
+        env_vars=[],
+        is_networked=True,
+        egress_policy={"default": "deny", "rules": [{"host": "example.com", "inject": "missing"}]},
+        egress_secrets={},
+        base_image="python:3.12",
+        memory_bytes=None,
+        cpus=None,
+    )
+    override = row_to_override(env)
+    # The except branch (dangling inject → from_stored raises) must have been taken.
+    assert override.egress is None
+
+
+@pytest.mark.asyncio
+@pytest.mark.django_db(transaction=True)
+async def test_row_to_override_drops_env_vars_on_decryption_error(mocker):
+    """A rotated/lost DAIV_ENCRYPTION_KEY must not crash an agent run: env_vars that can no longer be
+    decrypted are dropped (override.env_vars == {}) and the run proceeds. This is the agent-run analogue
+    of the form-layer decryption guard, distinct from the egress fail-closed branch."""
+    from sandbox_envs.services import row_to_override
+
+    from core.encryption import DecryptionError
+
+    env = await SandboxEnvironment.objects.acreate(
+        scope=Scope.GLOBAL,
+        name="rotated-vars",
+        base_image="python:3.12",
+        env_vars=[{"name": "API_KEY", "value": "s3cr3t", "is_secret": True}],
+    )
+
+    def _raise(instance):
+        raise DecryptionError("bad key")
+
+    mocker.patch.object(type(env), "env_vars", new_callable=lambda: property(fget=_raise))
+    override = row_to_override(env)
+    assert override.env_vars == {}
+
+
+def test_merge_prefers_per_run_egress():
+    from sandbox_envs.services import merge_sandbox_runtime
+
+    rt = merge_sandbox_runtime(
+        per_run=_ov(egress=_egress_request("per-run.example")),
+        global_default=_ov(egress=_egress_request("global.example")),
+    )
+    assert rt.egress.policy.rules[0].host == "per-run.example"
+
+
+def test_merge_egress_is_none_when_neither_side_has_it():
+    from sandbox_envs.services import merge_sandbox_runtime
+
+    # Egress is opt-in: no policy on either side must never materialize one (it would otherwise
+    # silently apply an unintended network posture).
+    rt = merge_sandbox_runtime(per_run=_ov(egress=None), global_default=_ov(egress=None))
+    assert rt.egress is None
+
+
+# ---------------------------------------------------------------------------
+# B3 tests — network_enabled removed from SandboxEnvOverride / SandboxRuntime
+# ---------------------------------------------------------------------------
+
+from sandbox_envs.services import merge_sandbox_runtime  # noqa: E402
+
+
+@pytest.fixture
+def make_egress():
+    """Return a factory that builds an EgressConfigRequest for a single host."""
+
+    def _factory(hosts: list[str]):
+        from pydantic import SecretStr
+
+        from core.sandbox.schemas import EgressConfigRequest, EgressPolicy, EgressRule, EgressSecret
+
+        rules = [EgressRule(host=h, inject="t") for h in hosts]
+        return EgressConfigRequest(
+            policy=EgressPolicy(rules=rules),
+            secrets={"t": EgressSecret(header="Authorization", value=SecretStr("Bearer x"))},
+        )
+
+    return _factory
+
+
+def _ov(**kw):
+    base = {"base_image": None, "memory_bytes": None, "cpus": None, "env_vars": {}, "egress": None}
+    base.update(kw)
+    return SandboxEnvOverride(**base)
+
+
+def test_sandbox_env_override_has_no_network_enabled():
+    assert not hasattr(_ov(), "network_enabled")
+
+
+def test_merge_takes_per_run_egress_off_even_when_global_has_policy(make_egress):
+    # per-run env explicitly Off (egress=None) must NOT inherit the global default's policy.
+    per_run = _ov(egress=None)
+    global_default = _ov(egress=make_egress(["github.com"]))
+    rt = merge_sandbox_runtime(per_run=per_run, global_default=global_default)
+    assert rt.egress is None
+    assert not hasattr(rt, "network_enabled")
+
+
+def test_merge_falls_back_to_global_egress_when_no_per_run():
+    eg = object()
+    rt = merge_sandbox_runtime(per_run=None, global_default=_ov(egress=eg))
+    assert rt.egress is eg
diff --git a/tests/unit_tests/sandbox_envs/test_views.py b/tests/unit_tests/sandbox_envs/test_views.py
index 9618fa418..3fe551baf 100644
--- a/tests/unit_tests/sandbox_envs/test_views.py
+++ b/tests/unit_tests/sandbox_envs/test_views.py
@@ -158,7 +158,7 @@ def test_create_htmx_post_success_fires_env_created(client, user):
             "description": "",
             "scope": Scope.USER,
             "base_image": "alpine:latest",
-            "network_choice": "default",
+            "network_choice": "off",
             "memory_value": "",
             "memory_unit": "MiB",
             "env_vars_json": "[]",
@@ -240,7 +240,7 @@ def test_create_context_includes_global_default_summary(client, user):
     resp = client.get(reverse("sandbox_envs:create"), HTTP_HX_REQUEST="true")
     assert resp.status_code == 200
     summary = resp.context["global_default_summary"]
-    assert set(summary.keys()) == {"network", "memory", "cpus", "has_network", "has_memory", "has_cpus"}
+    assert set(summary.keys()) == {"memory", "cpus", "has_memory", "has_cpus"}
 
 
 @pytest.mark.django_db
@@ -267,7 +267,7 @@ def test_edit_htmx_post_success_fires_env_updated(client, user):
             "base_image": "alpine:latest",
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "env_vars_json": "[]",
         },
         HTTP_HX_REQUEST="true",
@@ -328,7 +328,7 @@ def test_edit_global_default_post_preserves_is_default(client, admin):
             "base_image": "python:3.14",
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "env_vars_json": "[]",
         },
         HTTP_HX_REQUEST="true",
@@ -357,7 +357,7 @@ def test_edit_post_cannot_promote_via_is_default_field(client, admin):
             "base_image": "python:3.14",
             "memory_value": "",
             "memory_unit": "MiB",
-            "network_choice": "default",
+            "network_choice": "off",
             "env_vars_json": "[]",
             "is_default": "true",
         },
@@ -395,7 +395,7 @@ def test_invalid_create_post_preserves_submitted_env_vars(client, user):
             "name": "",
             "base_image": "alpine",
             "scope": Scope.USER,
-            "network_choice": "default",
+            "network_choice": "off",
             "memory_value": "",
             "memory_unit": "MiB",
             "env_vars_json": submitted_json,
@@ -501,7 +501,7 @@ def test_invalid_edit_post_preserves_submitted_env_vars(client, user):
             "name": "",
             "base_image": "alpine",
             "scope": Scope.USER,
-            "network_choice": "default",
+            "network_choice": "off",
             "memory_value": "",
             "memory_unit": "MiB",
             "env_vars_json": submitted_json,
@@ -510,3 +510,29 @@ def test_invalid_edit_post_preserves_submitted_env_vars(client, user):
     )
     assert resp.status_code == 200
     assert resp.context["form"]["env_vars_json"].value() == submitted_json
+
+
+@pytest.mark.django_db
+def test_edit_form_get_does_not_leak_egress_secret(client):
+    from accounts.models import User
+
+    user = User.objects.create_user(username="leak", email="leak@e.com", password="x")  # noqa: S106
+    client.force_login(user)
+    env = SandboxEnvironment.objects.create(
+        scope=Scope.USER,
+        user=user,
+        name="dev",
+        base_image="alpine:latest",
+        egress_policy={
+            "default": "deny",
+            "intercept": "all",
+            "rules": [{"host": "api.openai.com", "methods": ["*"], "inject": "s1"}],
+        },
+        egress_secrets={"s1": {"header": "Authorization", "value": "sk-TOPSECRET"}},
+    )
+    url = reverse("sandbox_envs:edit", args=[env.id])
+    resp = client.get(url, HTTP_HX_REQUEST="true")
+    assert resp.status_code == 200
+    body = resp.content.decode()
+    assert "sk-TOPSECRET" not in body  # plaintext value never rendered
+    assert "api.openai.com" in body  # the host itself is fine to show