diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index 5963862..d8a8211 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -378,6 +378,8 @@ ecosystem_default_domains:
     - static.crates.io
     - index.crates.io
     - rsproxy.cn
+    # Proton AG's public sparse Cargo registry (pvpnclient, muon).
+    - rust-registry.proton.me
   composer:
     - repo.packagist.org
     - packagist.org
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index fc77fea..e80a363 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -607,6 +607,7 @@ func TestEgressAllowlist_PublicRegistriesAllowed(t *testing.T) {
 		"https://go.googlesource.com/tools",
 		"https://android.googlesource.com/platform",
 		"https://nodejs.org/dist/index.json",
+		"https://rust-registry.proton.me/index/config.json",
 		"https://adsbynimbus-public.s3.amazonaws.com/android/sdks",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "public registry host allowed: "+allowed)
@@ -717,6 +718,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 	// moment its entry is changed to a leading-dot suffix, so this is the probe
 	// set that actually pins exact-host semantics.
 	childProbes := []string{
+		"https://evil.rust-registry.proton.me/payload",
 		"https://evil.docker.redpanda.com/payload",
 		"https://evil.appboy.github.io/payload",
 		"https://evil.juliaregistries.github.io/payload",