diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index f72728d..408646b 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -635,6 +635,17 @@ ecosystem_default_domains:
     # Project Calico (Tigera) chart repo, the documented `helm repo add` URL for
     # tigera-operator and crd.projectcalico.org.v1 (tarballs are on github.com).
     - docs.tigera.io
+    # Datadog's chart repo (CNAME to datadog.github.io); tarballs are on github.com.
+    - helm.datadoghq.com
+    # HashiCorp's chart repo (Consul, Vault, Boundary, ...); serves index and tarballs.
+    - helm.releases.hashicorp.com
+    # Teleport's chart repo (CloudFront); index and tarballs are on the same host.
+    - charts.releases.teleport.dev
+    # Wiz's chart repo; charts.wiz.io serves index.yaml, tarballs are on wiz-sec.github.io.
+    - charts.wiz.io
+    - wiz-sec.github.io
+    # Fluent's chart repo (GitHub Pages); tarballs are on github.com.
+    - fluent.github.io
   # GitHub-hosted or per-job configured; covered by github_infra_domains / git.
   # Note: additional per-job dependencies (e.g. pre_commit hooks that install
   # from other ecosystems) are covered because the handler applies the union of
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index 9227035..9dd86ce 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -751,6 +751,12 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://evil.traefik.github.io/payload",
 		"https://evil.helm.traefik.io/payload",
 		"https://evil.docs.tigera.io/payload",
+		"https://evil.helm.datadoghq.com/payload",
+		"https://evil.helm.releases.hashicorp.com/payload",
+		"https://evil.charts.releases.teleport.dev/payload",
+		"https://evil.charts.wiz.io/payload",
+		"https://evil.wiz-sec.github.io/payload",
+		"https://evil.fluent.github.io/payload",
 	}
 
 	// Sibling hosts: names sharing a parent with an added entry. These pin the
@@ -769,6 +775,10 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://attacker.external-secrets.io/payload",
 		"https://attacker.traefik.io/payload",
 		"https://attacker.tigera.io/payload",
+		"https://attacker.datadoghq.com/payload",
+		"https://attacker.releases.hashicorp.com/payload",
+		"https://attacker.releases.teleport.dev/payload",
+		"https://attacker.wiz.io/payload",
 		// Cloudsmith is multi-tenant with the tenant in the URL path, and the
 		// allowlist authorizes the hostname only. Neither the tenant subdomain
 		// form nor the shared download hosts may be globally allowed.
@@ -955,6 +965,12 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) {
 		"https://traefik.github.io/charts/traefik/traefik-41.6.1.tgz",
 		"https://helm.traefik.io/traefik/index.yaml",
 		"https://docs.tigera.io/calico/charts/index.yaml",
+		"https://helm.datadoghq.com/index.yaml",
+		"https://helm.releases.hashicorp.com/index.yaml",
+		"https://charts.releases.teleport.dev/index.yaml",
+		"https://charts.wiz.io/index.yaml",
+		"https://wiz-sec.github.io/charts/wiz-kubernetes-integration-0.2.0.tgz",
+		"https://fluent.github.io/helm-charts/index.yaml",
 		"https://cocoapods.org/pods/AFNetworking",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "added host should be allowed: "+allowed)