diff --git a/k8s/apps/amnezia/configmap-scripts.yaml b/k8s/apps/amnezia/configmap-scripts.yaml
index 35d721b..d17e21e 100644
--- a/k8s/apps/amnezia/configmap-scripts.yaml
+++ b/k8s/apps/amnezia/configmap-scripts.yaml
@@ -96,12 +96,18 @@ data:
           [[ "${source}" == \#* ]] && continue
           if [ -n "${extra:-}" ] \
             || ! valid_ipv4_32 "${source}" \
-            || ! valid_ipv4_32 "${destination:-}" \
-            || ! routed_through_awg0 "${source}" \
-            || ! routed_through_awg0 "${destination}"; then
-            echo "Invalid or out-of-tunnel policy line: ${source:-} ${destination:-} ${extra:-}" >&2
-            "${IPTABLES[@]}" -F "${inactive}"
-            return 1
+            || ! valid_ipv4_32 "${destination:-}"; then
+            echo "Skipping malformed policy line: ${source:-} ${destination:-} ${extra:-}" >&2
+            continue
+          fi
+          # A pair whose endpoints are not (yet) routed through awg0 is skipped
+          # rather than fatal. During interface bring-up the awg0 route may not be
+          # in place, and a missing ACCEPT simply leaves the pair subject to the
+          # client-isolation DROP below (fail-closed) instead of aborting the whole
+          # policy and crash-looping the container.
+          if ! routed_through_awg0 "${source}" || ! routed_through_awg0 "${destination}"; then
+            echo "Skipping out-of-tunnel policy pair: ${source} ${destination}" >&2
+            continue
           fi
           "${IPTABLES[@]}" -A "${inactive}" \
             -i awg0 -o awg0 -s "${source}" -d "${destination}" \