diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index 65d0bb2..44c55bd 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -617,6 +617,16 @@ ecosystem_default_domains:
     - prometheus-community.github.io
     - grafana.github.io
     - jaegertracing.github.io
+    - kedacore.github.io
+    - kyverno.github.io
+    - argoproj.github.io
+    - open-telemetry.github.io
+    - kubernetes-sigs.github.io
+    - vmware-tanzu.github.io
+    - bitnami.github.io
+    - charts.external-secrets.io
+    # Redirect target of charts.external-secrets.io.
+    - external-secrets.io
     # Traefik Labs' chart repo: traefik.github.io is the documented repo URL
     # and serves the chart tarballs; helm.traefik.io is the legacy repo URL
     # serving the same index.yaml (whose tarball URLs point at traefik.github.io).
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index 5ccb2d9..f34324a 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -739,6 +739,15 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://evil.maven.artifacts.atlassian.com/maven",
 		"https://evil.mirrors.huaweicloud.com/repository/npm",
 		"https://evil.dotnetcli.blob.core.windows.net/payload",
+		"https://evil.kedacore.github.io/payload",
+		"https://evil.kyverno.github.io/payload",
+		"https://evil.argoproj.github.io/payload",
+		"https://evil.open-telemetry.github.io/payload",
+		"https://evil.kubernetes-sigs.github.io/payload",
+		"https://evil.vmware-tanzu.github.io/payload",
+		"https://evil.bitnami.github.io/payload",
+		"https://evil.charts.external-secrets.io/payload",
+		"https://evil.external-secrets.io/payload",
 		"https://evil.traefik.github.io/payload",
 		"https://evil.helm.traefik.io/payload",
 		"https://evil.docs.tigera.io/payload",
@@ -757,6 +766,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://attacker.artifacts.atlassian.com/maven",
 		"https://attacker.huaweicloud.com/repository/npm",
 		"https://attacker.julialang.org/bin",
+		"https://attacker.external-secrets.io/payload",
 		"https://attacker.traefik.io/payload",
 		"https://attacker.tigera.io/payload",
 		// Cloudsmith is multi-tenant with the tenant in the URL path, and the
@@ -933,6 +943,15 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) {
 		"https://prometheus-community.github.io/helm-charts/index.yaml",
 		"https://grafana.github.io/helm-charts/index.yaml",
 		"https://jaegertracing.github.io/helm-charts/index.yaml",
+		"https://kedacore.github.io/charts/index.yaml",
+		"https://kyverno.github.io/kyverno/index.yaml",
+		"https://argoproj.github.io/argo-helm/index.yaml",
+		"https://open-telemetry.github.io/opentelemetry-helm-charts/index.yaml",
+		"https://kubernetes-sigs.github.io/external-dns/index.yaml",
+		"https://vmware-tanzu.github.io/helm-charts/index.yaml",
+		"https://bitnami.github.io/sealed-secrets/index.yaml",
+		"https://charts.external-secrets.io/index.yaml",
+		"https://external-secrets.io/index.yaml",
 		"https://traefik.github.io/charts/traefik/traefik-41.6.1.tgz",
 		"https://helm.traefik.io/traefik/index.yaml",
 		"https://docs.tigera.io/calico/charts/index.yaml",