diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml
index 5963862..fcbd1e9 100644
--- a/internal/handlers/egress_allowlist_defaults.yaml
+++ b/internal/handlers/egress_allowlist_defaults.yaml
@@ -656,6 +656,8 @@ ecosystem_default_domains:
     - wiz-sec.github.io
     # Fluent's chart repo (GitHub Pages); tarballs are on github.com.
     - fluent.github.io
+    # Percona's chart repo (GitHub Pages); tarballs are on github.com.
+    - percona.github.io
   # GitHub-hosted or per-job configured; covered by github_infra_domains / git.
   # Note: additional per-job dependencies (e.g. pre_commit hooks that install
   # from other ecosystems) are covered because the handler applies the union of
diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go
index fc77fea..245a2e2 100644
--- a/internal/handlers/egress_allowlist_test.go
+++ b/internal/handlers/egress_allowlist_test.go
@@ -759,6 +759,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) {
 		"https://evil.charts.wiz.io/payload",
 		"https://evil.wiz-sec.github.io/payload",
 		"https://evil.fluent.github.io/payload",
+		"https://evil.percona.github.io/payload",
 		"https://evil.adsbynimbus-public.s3.amazonaws.com/payload",
 	}
 
@@ -974,6 +975,7 @@ func TestEgressAllowlist_AddedMissingDomainsAllowed(t *testing.T) {
 		"https://charts.wiz.io/index.yaml",
 		"https://wiz-sec.github.io/charts/wiz-kubernetes-integration-0.2.0.tgz",
 		"https://fluent.github.io/helm-charts/index.yaml",
+		"https://percona.github.io/percona-helm-charts/index.yaml",
 		"https://cocoapods.org/pods/AFNetworking",
 	} {
 		assert.Nil(t, egressResult(t, h, allowed), "added host should be allowed: "+allowed)