diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md
index 1785e714e..a2f2289bf 100644
--- a/k8s/charts/seaweedfs/README.md
+++ b/k8s/charts/seaweedfs/README.md
@@ -373,7 +373,9 @@ In a namespace with a default-deny policy the install hangs: the components cann
 helm install seaweedfs seaweedfs/seaweedfs --set networkPolicy.enabled=true
 ```
 
-That alone leaves outbound traffic untouched. Restricting egress is a second opt-in, because the chart knows where its own components live but not where your filer store, notification sink or remote tier does:
+That alone leaves outbound traffic untouched, which is enough when the namespace's default-deny only restricts ingress. If it lists `Egress` in its `policyTypes` too - the usual baseline - the components still cannot resolve DNS, and you need the second opt-in below as well.
+
+Egress is separate because the chart knows where its own components live but not where your filer store, notification sink or remote tier does, and because in a namespace with no default-deny at all, adding egress rules would narrow the components from "may reach anything" to "may reach these peers":
 
 ```yaml
 networkPolicy:
diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index 65e8e3161..e7bce0728 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -1816,6 +1816,11 @@ networkPolicy:
   # the cluster default (usually allow-all) applies. Turn this on for a
   # namespace with a default-deny policy, where the components otherwise
   # cannot reach each other and the install hangs.
+  #
+  # This alone covers a default-deny that only restricts ingress. If yours has
+  # Egress in its policyTypes as well - the usual baseline - the components
+  # still cannot resolve DNS or reach each other, and you need egress.enabled
+  # below too, together with an extraEgress entry for the filer store.
   enabled: false
 
   # One policy is rendered per component, selecting its pods by the standard
@@ -1861,6 +1866,11 @@ networkPolicy:
     # components, but not where your filer store (MySQL, Postgres, Redis,
     # ...), notification sink or remote tier lives. Enabling this without
     # listing those under extraEgress will cut the filer off from its store.
+    #
+    # It cannot be on by default either. In a namespace with no default-deny,
+    # egress rules would take the components from "may reach anything" down to
+    # "may reach the peers listed here", which is the same breakage from the
+    # other direction. Required if your default-deny covers egress.
     enabled: false
 
     # Every component resolves its peers by DNS name, so this is required