diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index 3b23c72..b48f692 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -677,5 +677,10 @@ ecosystem_default_domains:
     # Package.swift (bytedance/AdsGlobalPackage). Anonymous, no redirect.
     # Exact: the rest of i18n-pglstatp.com is not needed and not vetted.
     - sf16-fe-tos-sg.i18n-pglstatp.com
+    # Vindral's (RealSprint) SDK host, serving the VindralStreaming zip
+    # binaryTarget declared in the vendor's own public Package.swift
+    # (RealSprint/vindral-apple-sdk-spm). Anonymous, no redirect.
+    # Exact: *.vindral.com also fronts the vendor's CDN and stage/test hosts.
+    - applesdk.vindral.com
   vcpkg: []
   pre_commit: []
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index 83454c3..dc6319a 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -1277,6 +1277,8 @@ func TestEgressAllowlist_PublicVendorRegistriesAllowed(t *testing.T) {
 		// Same failure mode for Pangle's PAGAdSDK and TikTokBusinessSDK binaryTargets.
 		"https://sf16-fe-tos-sg.i18n-pglstatp.com/obj/pangle-sdk-static-va/8.3.0.8/PAGAdSDK.xcframework.zip",
 		"https://sf16-fe-tos-sg.i18n-pglstatp.com/obj/pangle-sdk-static-va/8.3.0.8/TikTokBusinessSDK.xcframework.zip",
+		// Same failure mode for the Vindral Apple SDK's VindralStreaming binaryTarget.
+		"https://applesdk.vindral.com/tag/1.2.0/VindralStreaming.zip",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "public vendor registry allowed: "+allowed)
 	}
@@ -1323,6 +1325,11 @@ func TestEgressAllowlist_PublicVendorRegistriesAllowed(t *testing.T) {
 		"https://evil.sf16-fe-tos-sg.i18n-pglstatp.com/payload",
 		"https://attacker.i18n-pglstatp.com/payload",
 		"https://i18n-pglstatp.com/payload",
+		// vindral.com serves a wildcard cert covering its CDN and stage/test
+		// hosts, so the SDK host must not open the parent or any sibling.
+		"https://evil.applesdk.vindral.com/payload",
+		"https://attacker.vindral.com/payload",
+		"https://vindral.com/payload",
 	} {
 		resp := egressResult(t, h, blocked)
 		if assert.NotNil(t, resp, "must stay blocked: "+blocked) {