diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index a4bc650..1899baf 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -604,6 +604,14 @@ ecosystem_default_domains:
     - prometheus-community.github.io
     - grafana.github.io
     - jaegertracing.github.io
+    # Traefik Labs' chart repo: traefik.github.io is the documented repo URL
+    # and serves the chart tarballs; helm.traefik.io is the legacy repo URL
+    # serving the same index.yaml (whose tarball URLs point at traefik.github.io).
+    - traefik.github.io
+    - helm.traefik.io
+    # Project Calico (Tigera) chart repo, the documented `helm repo add` URL for
+    # tigera-operator and crd.projectcalico.org.v1 (tarballs are on github.com).
+    - docs.tigera.io
   # GitHub-hosted or per-job configured; covered by github_infra_domains / git.
   # Note: additional per-job dependencies (e.g. pre_commit hooks that install
   # from other ecosystems) are covered because the handler applies the union of
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index fb87892..89a28bb 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -729,6 +729,9 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://evil.maven.artifacts.atlassian.com/maven",
 		"https://evil.mirrors.huaweicloud.com/repository/npm",
 		"https://evil.dotnetcli.blob.core.windows.net/payload",
+		"https://evil.traefik.github.io/payload",
+		"https://evil.helm.traefik.io/payload",
+		"https://evil.docs.tigera.io/payload",
 	}
 
 	// Sibling hosts: names sharing a parent with an added entry. These pin the
@@ -744,6 +747,8 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://attacker.artifacts.atlassian.com/maven",
 		"https://attacker.huaweicloud.com/repository/npm",
 		"https://attacker.julialang.org/bin",
+		"https://attacker.traefik.io/payload",
+		"https://attacker.tigera.io/payload",
 		// Cloudsmith is multi-tenant with the tenant in the URL path, and the
 		// allowlist authorizes the hostname only. Neither the tenant subdomain
 		// form nor the shared download hosts may be globally allowed.
@@ -918,6 +923,9 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) {
 		"https://prometheus-community.github.io/helm-charts/index.yaml",
 		"https://grafana.github.io/helm-charts/index.yaml",
 		"https://jaegertracing.github.io/helm-charts/index.yaml",
+		"https://traefik.github.io/charts/traefik/traefik-41.6.1.tgz",
+		"https://helm.traefik.io/traefik/index.yaml",
+		"https://docs.tigera.io/calico/charts/index.yaml",
 		"https://cocoapods.org/pods/AFNetworking",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "added host should be allowed: "+allowed)