diff --git a/packages/apps/tenant/templates/networkpolicy.yaml b/packages/apps/tenant/templates/networkpolicy.yaml
index 84df6d11..269df3b8 100644
--- a/packages/apps/tenant/templates/networkpolicy.yaml
+++ b/packages/apps/tenant/templates/networkpolicy.yaml
@@ -34,6 +34,21 @@ spec:
       - world
 ---
 apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-world-egress
+  namespace: {{ include "tenant.name" . }}
+spec:
+  endpointSelector:
+    matchExpressions:
+    - key: policy.cozystack.io/allow-world-egress
+      operator: In
+      values: ["true"]
+  egress:
+  - toEntities:
+      - world
+---
+apiVersion: cilium.io/v2
 kind: CiliumClusterwideNetworkPolicy
 metadata:
   name: {{ include "tenant.name" . }}-egress
diff --git a/packages/apps/virtual-machine/templates/service.yaml b/packages/apps/virtual-machine/templates/service.yaml
index d9d77825..7fd9644c 100644
--- a/packages/apps/virtual-machine/templates/service.yaml
+++ b/packages/apps/virtual-machine/templates/service.yaml
@@ -49,6 +49,3 @@ spec:
           - port: {{ quote . }}
           {{- end }}
     {{- end }}
-  egress:
-  - toEntities:
-      - world
diff --git a/packages/apps/virtual-machine/templates/vm.yaml b/packages/apps/virtual-machine/templates/vm.yaml
index 1d7652e8..a24ac8b3 100644
--- a/packages/apps/virtual-machine/templates/vm.yaml
+++ b/packages/apps/virtual-machine/templates/vm.yaml
@@ -62,9 +62,10 @@ spec:
   template:
     metadata:
       annotations:
-        policy.cozystack.io/allow-external-communication: "false"
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
       labels:
+        policy.cozystack.io/allow-external-communication: "false"
+        policy.cozystack.io/allow-world-egress: "true"
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:
       domain:
diff --git a/packages/apps/vm-instance/templates/service.yaml b/packages/apps/vm-instance/templates/service.yaml
index d1ef4df9..b6b52789 100644
--- a/packages/apps/vm-instance/templates/service.yaml
+++ b/packages/apps/vm-instance/templates/service.yaml
@@ -49,6 +49,3 @@ spec:
         - port: {{ quote . }}
         {{- end }}
     {{- end }}
-  egress:
-  - toEntities:
-      - world
diff --git a/packages/apps/vm-instance/templates/vm.yaml b/packages/apps/vm-instance/templates/vm.yaml
index e64ec2f6..a4292c73 100644
--- a/packages/apps/vm-instance/templates/vm.yaml
+++ b/packages/apps/vm-instance/templates/vm.yaml
@@ -26,9 +26,10 @@ spec:
   template:
     metadata:
       annotations:
-        policy.cozystack.io/allow-external-communication: "false"
         kubevirt.io/allow-pod-bridge-network-live-migration: "true"
       labels:
+        policy.cozystack.io/allow-external-communication: "false"
+        policy.cozystack.io/allow-world-egress: "true"
         {{- include "virtual-machine.labels" . | nindent 8 }}
     spec:
       domain: