diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index a4bc650..287f2de 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -472,6 +472,15 @@ ecosystem_default_domains:
     # the Kubernetes release infrastructure, so no subdomain is user-creatable.
     # The `k8s.io` entry in go_modules is exact and does not cover this host.
     - registry.k8s.io
+    # NVIDIA NGC container registry. Public NGC images need no sign-in: /v2/
+    # advertises a Bearer realm on the same host (nvcr.io/proxy_auth), which
+    # issues a guest token with pull access to public repositories only. Blobs
+    # 307-redirect to layers.nvcr.io, NVIDIA's CloudFront distribution, which
+    # serves only URLs signed by nvcr.io and 403s unsigned requests. Exact only:
+    # tenancy is path-based (nvcr.io/<org>/<team>/<image>), and private org
+    # images still need an NGC API key under `registries:`.
+    - nvcr.io
+    - layers.nvcr.io
   docker_compose: *docker_registries
   nuget:
     - api.nuget.org
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index fb87892..9ca376c 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -270,6 +270,12 @@ func TestEgressAllowlist_PublicVendorOCIRegistriesAllowed(t *testing.T) {
 		"https://registry.k8s.io/v2/coredns/coredns/manifests/v1.14.7",
 		"https://registry.k8s.io/token?scope=repository:coredns/coredns:pull&service=registry.k8s.io",
 		"https://europe-west8-docker.pkg.dev/v2/k8s-artifacts-prod/images/coredns/coredns/tags/list",
+		// NVIDIA NGC: same-host guest token service, and blobs 307-redirect to
+		// NVIDIA's signed-URL CloudFront host.
+		"https://nvcr.io/v2/nvidia/cuda/tags/list",
+		"https://nvcr.io/v2/nvidia/distroless/go/manifests/v4.1.4",
+		"https://nvcr.io/proxy_auth?account&scope=repository:nvidia/cuda:pull&service=registry",
+		"https://layers.nvcr.io/registry/docker/registry/v2/blobs/sha256/ab/abc/data",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "public vendor OCI host allowed: "+allowed)
 	}
@@ -282,6 +288,8 @@ func TestEgressAllowlist_PublicVendorOCIRegistriesAllowed(t *testing.T) {
 		"https://evil.cgr.dev/v2/",
 		"https://evil.registry.access.redhat.com/v2/",
 		"https://evil.registry.k8s.io/v2/",
+		"https://evil.nvcr.io/v2/",
+		"https://evil.layers.nvcr.io/registry/",
 		// The Go vanity-import entry for k8s.io is exact, so the apex and its
 		// other subdomains stay closed even with registry.k8s.io allowed.
 		"https://attacker.k8s.io/v2/",