diff --git a/charts/jellyfin/templates/networkpolicy.yaml b/charts/jellyfin/templates/networkpolicy.yaml
new file mode 100644
index 0000000..5af3206
--- /dev/null
+++ b/charts/jellyfin/templates/networkpolicy.yaml
@@ -0,0 +1,109 @@
+{{- if .Values.networkPolicy.enabled }}
+{{- if or .Values.jellyfin.enableDLNA .Values.podPrivileges.hostNetwork }}
+{{- fail "NetworkPolicy cannot be enabled when hostNetwork is enabled (DLNA mode or podPrivileges.hostNetwork). NetworkPolicy does not apply to pods using hostNetwork. Please set networkPolicy.enabled=false or disable hostNetwork." }}
+{{- end }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "jellyfin.fullname" . }}
+  labels:
+    {{- include "jellyfin.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "jellyfin.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    {{- toYaml .Values.networkPolicy.policyTypes | nindent 4 }}
+
+  {{- if has "Ingress" .Values.networkPolicy.policyTypes }}
+  ingress:
+    # Allow traffic to Jellyfin HTTP port
+    - ports:
+        - protocol: TCP
+          port: http
+      {{- if not .Values.networkPolicy.ingress.allowExternal }}
+      from:
+        {{- if or .Values.networkPolicy.ingress.podSelector .Values.networkPolicy.ingress.namespaceSelector }}
+        - podSelector:
+            {{- toYaml .Values.networkPolicy.ingress.podSelector | nindent 12 }}
+          {{- if .Values.networkPolicy.ingress.namespaceSelector }}
+          namespaceSelector:
+            {{- toYaml .Values.networkPolicy.ingress.namespaceSelector | nindent 12 }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+
+    {{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+    # Allow Prometheus metrics scraping
+    - ports:
+        - protocol: TCP
+          port: {{ .Values.metrics.serviceMonitor.port }}
+      from:
+        - podSelector:
+            {{- toYaml .Values.networkPolicy.metrics.podSelector | nindent 12 }}
+          {{- if .Values.networkPolicy.metrics.namespace }}
+          namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.metrics.namespace }}
+          {{- end }}
+    {{- end }}
+
+    {{- with .Values.networkPolicy.ingress.customRules }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+
+  {{- if has "Egress" .Values.networkPolicy.policyTypes }}
+  egress:
+    {{- if .Values.networkPolicy.egress.allowDNS }}
+    # Allow DNS resolution (required for Jellyfin operation)
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Values.networkPolicy.egress.dnsNamespace }}
+          podSelector:
+            matchLabels:
+              {{- toYaml .Values.networkPolicy.egress.dnsPodSelector | nindent 14 }}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    {{- end }}
+
+    {{- if .Values.networkPolicy.egress.allowAllEgress }}
+    # Allow all egress traffic (metadata providers, subtitles, images, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+    {{- else }}
+      {{- if .Values.networkPolicy.egress.restrictedEgress.allowMetadata }}
+    # Allow HTTPS for metadata providers (TMDB, TheTVDB, OpenSubtitles, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 443
+      {{- end }}
+
+      {{- if .Values.networkPolicy.egress.restrictedEgress.allowInCluster }}
+    # Allow pod-to-pod communication within the cluster
+    - to:
+        - podSelector: {}
+      {{- end }}
+
+      {{- range .Values.networkPolicy.egress.restrictedEgress.allowedCIDRs }}
+    # Custom CIDR egress rule
+    - to:
+        - ipBlock:
+            cidr: {{ . }}
+      {{- end }}
+    {{- end }}
+
+    {{- with .Values.networkPolicy.egress.customRules }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+{{- end }}