diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 0d8a34b42..adbb25e22 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -2191,61 +2191,42 @@ jobs:
           # mutates nested selectors. The checkout is depth=1, so snapshot live
           # policy truth and remove server-only metadata before any mutation.
           NETWORK_POLICY_ROLLBACK_FILE="/tmp/awoooi-network-policy-rollback.json"
-          NETWORK_POLICY_LIVE_RAW_FILE="/tmp/awoooi-network-policy-live.json"
           NETWORK_POLICY_CHANGE_ACTIVE="0"
           BROKER_POLICY_NAME="allow-ansible-executor-broker-ssh-egress"
           BROKER_POLICY_EXISTED=$(ssh $SSH_OPTS "wooo@${{ env.K8S_SSH_HOST }}" \
             "KUBECTL='sudo kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml --server=${{ env.K8S_API_SERVER }}'; if \$KUBECTL get networkpolicy '$BROKER_POLICY_NAME' -n awoooi-prod >/dev/null 2>&1; then printf 1; else printf 0; fi")
+          NETWORK_POLICY_NAMES=(
+            default-deny-all
+            allow-nginx-ingress
+            allow-required-egress
+            deny-legacy-access
+          )
+          if [ "$BROKER_POLICY_EXISTED" = "1" ]; then
+            NETWORK_POLICY_NAMES+=("$BROKER_POLICY_NAME")
+          fi
           ssh $SSH_OPTS "wooo@${{ env.K8S_SSH_HOST }}" \
-            "KUBECTL='sudo kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml --server=${{ env.K8S_API_SERVER }}'; \$KUBECTL get networkpolicy -n awoooi-prod -o json" \
-            > "$NETWORK_POLICY_LIVE_RAW_FILE"
-          python3 - "$NETWORK_POLICY_LIVE_RAW_FILE" \
-            "$NETWORK_POLICY_ROLLBACK_FILE" <<'PY'
+            "KUBECTL='sudo kubectl --kubeconfig=/etc/rancher/k3s/k3s.yaml --server=${{ env.K8S_API_SERVER }}'; \$KUBECTL get networkpolicy ${NETWORK_POLICY_NAMES[*]} -n awoooi-prod -o json" \
+            | python3 -c '
           import json
           import sys
-          from pathlib import Path
 
-          source_path = Path(sys.argv[1])
-          rollback_path = Path(sys.argv[2])
-          payload = json.loads(source_path.read_text(encoding="utf-8"))
-          items = payload.get("items") or []
-          if not items:
-              raise SystemExit("live NetworkPolicy snapshot is empty")
-
-          sanitized = []
-          for item in items:
-              metadata = item.get("metadata") or {}
-              clean_metadata = {
-                  "name": metadata["name"],
-                  "namespace": metadata.get("namespace", "awoooi-prod"),
+          source = json.load(sys.stdin)
+          items = [
+              {
+                  "apiVersion": item["apiVersion"],
+                  "kind": item["kind"],
+                  "metadata": {
+                      "name": item["metadata"]["name"],
+                      "namespace": item["metadata"]["namespace"],
+                  },
+                  "spec": item["spec"],
               }
-              if metadata.get("labels"):
-                  clean_metadata["labels"] = metadata["labels"]
-              annotations = dict(metadata.get("annotations") or {})
-              annotations.pop(
-                  "kubectl.kubernetes.io/last-applied-configuration",
-                  None,
-              )
-              if annotations:
-                  clean_metadata["annotations"] = annotations
-              sanitized.append(
-                  {
-                      "apiVersion": item["apiVersion"],
-                      "kind": item["kind"],
-                      "metadata": clean_metadata,
-                      "spec": item["spec"],
-                  }
-              )
-
-          rollback_path.write_text(
-              json.dumps(
-                  {"apiVersion": "v1", "kind": "List", "items": sanitized},
-                  separators=(",", ":"),
-              ),
-              encoding="utf-8",
-          )
-          PY
-          rm -f "$NETWORK_POLICY_LIVE_RAW_FILE"
+              for item in source["items"]
+          ]
+          json.dump({"apiVersion": "v1", "kind": "List", "items": items}, sys.stdout)
+          ' \
+            > "$NETWORK_POLICY_ROLLBACK_FILE"
+          test -s "$NETWORK_POLICY_ROLLBACK_FILE"
           restore_network_policy() {
             echo "⏪ restoring previous AWOOOI NetworkPolicy contract"
             if cat "$NETWORK_POLICY_ROLLBACK_FILE" | \
diff --git a/apps/api/tests/test_executor_network_policy_boundary.py b/apps/api/tests/test_executor_network_policy_boundary.py
index 52f16174b..87f821d2b 100644
--- a/apps/api/tests/test_executor_network_policy_boundary.py
+++ b/apps/api/tests/test_executor_network_policy_boundary.py
@@ -70,10 +70,13 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
 
     assert "02-network-policy.yaml" in workflow
     assert "NETWORK_POLICY_ROLLBACK_FILE" in workflow
-    assert "get networkpolicy -n awoooi-prod -o json" in workflow
+    assert "get networkpolicy ${NETWORK_POLICY_NAMES[*]}" in workflow
     assert "rollback_network_policy_on_exit" in workflow
     assert "git show HEAD^:k8s/awoooi-prod/02-network-policy.yaml" not in workflow
     assert "BROKER_POLICY_EXISTED" in workflow
+    assert "NETWORK_POLICY_NAMES" in workflow
+    assert "item[\"metadata\"][\"name\"]" in workflow
+    assert "item[\"spec\"]" in workflow
     assert "$KUBECTL delete networkpolicy '$BROKER_POLICY_NAME'" in workflow
     assert "auth_can_i()" in workflow
     assert "API_CAN_PATCH=$(auth_can_i" in workflow