diff --git a/ci/networkpolicy/minecraft-server.yaml b/ci/networkpolicy/minecraft-server.yaml
new file mode 100644
index 0000000..7456a5c
--- /dev/null
+++ b/ci/networkpolicy/minecraft-server.yaml
@@ -0,0 +1,31 @@
+# Overlay for the NetworkPolicy render test (Gitea #5), applied last.
+#
+# This chart's policy has two branches that its own CI fixture never renders,
+# and both carry a mistake worth catching mechanically.
+#
+# 1. THE NODEPORT BRANCH OF THE GAME-PORT RULE. The rule is OPEN when
+#    server.service.type is NodePort - players arrive from the internet,
+#    already masqueraded - and RESTRICTED to the namespace otherwise. The
+#    install-test fixture uses ClusterIP (as all four releases in this cluster
+#    do), so without this overlay the open branch was rendered NOWHERE: not by
+#    the defaults, not by the fixture, not by lint. It is also the branch where
+#    writing server.service.outwardPort instead of server.port would be the
+#    classic NodePort mistake, and assertion 2 only sees a rule it has been
+#    given.
+#
+# 2. THE RCON RULE, which is gated on server.rcon.enabled exactly as the
+#    containerPort is. That pairing was wrong once while this chart was being
+#    written - the rule had no gate, so it named a port the pod does not
+#    declare - and assertion 2 caught it. Switching RCON on here keeps the
+#    PAIR under test rather than just the gate.
+#
+# Note why this chart's overlay does NOT have to render a source-restricted
+# probe rule, which is what the test demands of an overlay elsewhere: all three
+# of this chart's probes are exec probes, so it has no probe rule at all and
+# offers no networkPolicy.probeSources. The guard is conditional on that value
+# for this reason.
+server:
+  service:
+    type: NodePort
+  rcon:
+    enabled: true
diff --git a/ci/run-networkpolicy-test.sh b/ci/run-networkpolicy-test.sh
index 5f0b957..d5cf0be 100755
--- a/ci/run-networkpolicy-test.sh
+++ b/ci/run-networkpolicy-test.sh
@@ -743,6 +743,7 @@ if policies:
         ok("the rendered NetworkPolicy manifest(s) carry no \"#\" comment - all "
            "reasoning stayed in template comments")
 
+print("OFFERSPS|%d" % (1 if offers_probe_sources else 0))
 print("RESTRICTED|%d" % RESTRICTED_RULES)
 print("PROBERESTRICTED|%d" % PROBE_RESTRICTED)
 for line in lines:
@@ -763,6 +764,7 @@ PY
   CHART_SKIP=0
   CHART_RESTRICTED=0
   CHART_PROBE_RESTRICTED=0
+  CHART_OFFERS_PS=0
   while IFS='|' read -r VERDICT DETAIL; do
     case "$VERDICT" in
       OK)
@@ -779,6 +781,9 @@ PY
       PROBERESTRICTED)
         CHART_PROBE_RESTRICTED="$DETAIL"
         ;;
+      OFFERSPS)
+        CHART_OFFERS_PS="$DETAIL"
+        ;;
       FAIL)
         CHART_FAIL=1
         echo "  FAIL   $DETAIL"
@@ -797,7 +802,7 @@ PY
     FAILED="$FAILED $CHART"
     SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | $CHART_OK | $CHART_SKIP |"$'\n'
     echo "$CHART: FAILED"
-  elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_PROBE_RESTRICTED" -eq 0 ]; then
+  elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_OFFERS_PS" -eq 1 ] && [ "$CHART_PROBE_RESTRICTED" -eq 0 ]; then
     # The overlay's ONE job is to render a code path the chart's defaults do not
     # reach - above all the RESTRICTED probe rule, which only appears once
     # probeSources is non-empty. If no restricted rule came out, this test is