diff --git a/pkg/discovery/discovery.go b/pkg/discovery/discovery.go
index fecf9113a7..c3a25caf90 100644
--- a/pkg/discovery/discovery.go
+++ b/pkg/discovery/discovery.go
@@ -674,10 +674,11 @@ func (s *Scanner) resolveProfile(subnet string) (*envdetect.EnvironmentProfile,
 	}
 
 	manualProfile := &envdetect.EnvironmentProfile{
-		Type:       envdetect.Unknown,
-		Confidence: 1.0,
-		Policy:     s.policy,
-		Warnings:   []string{"Manual subnet override applied"},
+		Type:        envdetect.Unknown,
+		Confidence:  1.0,
+		Policy:      s.policy,
+		IPBlocklist: append([]net.IP(nil), s.profile.IPBlocklist...),
+		Warnings:    []string{"Manual subnet override applied"},
 		Metadata: map[string]string{
 			"manual_subnets": strings.Join(renderedSubnets, ","),
 		},
@@ -827,6 +828,9 @@ func cloneProfile(profile *envdetect.EnvironmentProfile) *envdetect.EnvironmentP
 	if profile.ExtraTargets != nil {
 		cloned.ExtraTargets = append([]net.IP(nil), profile.ExtraTargets...)
 	}
+	if profile.IPBlocklist != nil {
+		cloned.IPBlocklist = append([]net.IP(nil), profile.IPBlocklist...)
+	}
 	if profile.Phases != nil {
 		cloned.Phases = make([]envdetect.SubnetPhase, len(profile.Phases))
 		for i, phase := range profile.Phases {
diff --git a/pkg/discovery/discovery_test.go b/pkg/discovery/discovery_test.go
index 93923bbfc8..0ec9cbf47c 100644
--- a/pkg/discovery/discovery_test.go
+++ b/pkg/discovery/discovery_test.go
@@ -1160,6 +1160,23 @@ func TestCloneProfile(t *testing.T) {
 		}
 	})
 
+	t.Run("IP blocklist is deep copied", func(t *testing.T) {
+		input := &envdetect.EnvironmentProfile{
+			Type:        envdetect.Native,
+			IPBlocklist: []net.IP{net.ParseIP("192.168.1.10")},
+		}
+		result := cloneProfile(input)
+
+		if len(result.IPBlocklist) != 1 || result.IPBlocklist[0].String() != "192.168.1.10" {
+			t.Fatalf("IPBlocklist = %v, want [192.168.1.10]", result.IPBlocklist)
+		}
+
+		result.IPBlocklist[0] = net.ParseIP("10.0.0.10")
+		if input.IPBlocklist[0].String() != "192.168.1.10" {
+			t.Errorf("original IPBlocklist was modified: got %v", input.IPBlocklist[0])
+		}
+	})
+
 	t.Run("phases are deep copied", func(t *testing.T) {
 		_, subnet, _ := net.ParseCIDR("172.17.0.0/16")
 		input := &envdetect.EnvironmentProfile{
@@ -1216,3 +1233,21 @@ func TestCloneProfile(t *testing.T) {
 		}
 	})
 }
+
+func TestResolveProfileManualSubnetPreservesIPBlocklist(t *testing.T) {
+	t.Parallel()
+
+	scanner := NewScannerWithProfile(&envdetect.EnvironmentProfile{
+		Type:        envdetect.Native,
+		Policy:      envdetect.DefaultScanPolicy(),
+		IPBlocklist: []net.IP{net.ParseIP("10.0.1.10")},
+	})
+
+	profile, err := scanner.resolveProfile("10.0.1.0/24")
+	if err != nil {
+		t.Fatalf("resolveProfile returned error: %v", err)
+	}
+	if len(profile.IPBlocklist) != 1 || profile.IPBlocklist[0].String() != "10.0.1.10" {
+		t.Fatalf("manual profile IPBlocklist = %v, want [10.0.1.10]", profile.IPBlocklist)
+	}
+}