diff --git a/k8s/apps/amnezia/configmap-scripts.yaml b/k8s/apps/amnezia/configmap-scripts.yaml
index d17e21e..cc5a4a8 100644
--- a/k8s/apps/amnezia/configmap-scripts.yaml
+++ b/k8s/apps/amnezia/configmap-scripts.yaml
@@ -276,9 +276,13 @@ data:
       exit 1
     fi
 
-    FIRST_FORWARD_RULE="$("${IPTABLES[@]}" -S FORWARD | grep '^-A FORWARD ' | sed -n '1p')"
-    [[ "${FIRST_FORWARD_RULE}" == *"--comment amneziawg-forward-jump"* ]]
-    [[ "${FIRST_FORWARD_RULE}" == *"-j ${FORWARD_CHAIN}"* ]]
+    # The amneziawg FORWARD jump must be present. firewall-up inserts it at
+    # position 1, but CNI controllers (e.g. kube-router) legitimately re-assert
+    # their own jump ahead of it. Requiring the strict first position makes the
+    # readiness probe flap as the two fight over rule order. Isolation still holds
+    # as long as the jump is traversed and no earlier rule accepts awg0-to-awg0
+    # traffic (kube-router's chain returns non-pod traffic without a decision).
+    "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
     ACTIVE_POLICY="$("${IPTABLES[@]}" -S "${FORWARD_CHAIN}" 2>/dev/null \
       | awk '$1 == "-A" && $3 == "-j" && $4 ~ /^AMNEZIAWG-POLICY-[AB]$/ { print $4; exit }')"
     [ -n "${ACTIVE_POLICY}" ]