diff --git a/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml b/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml
new file mode 100644
index 00000000..466541ce
--- /dev/null
+++ b/charts/ztvp-certificates/templates/ca-extractor-netpol.yaml
@@ -0,0 +1,38 @@
+{{- if .Values.enabled }}
+---
+# Egress NetworkPolicy for the CA extractor Job/CronJob.
+# Required on OCP 4.22+ where platform-managed default-deny-all
+# NetworkPolicies block all egress from pods in openshift-config.
+# On OCP 4.21 and earlier this policy is harmless (no default-deny exists).
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "ztvp-certificates.fullname" . }}-ca-extractor-allow-egress
+  namespace: {{ .Values.global.namespace }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "22"
+  labels:
+    {{- include "ztvp-certificates.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "ztvp-certificates.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Egress
+  egress:
+  # Kubernetes API server — port-only rule because API endpoints
+  # are node IPs after DNAT and cannot be matched by podSelector
+  - ports:
+    - protocol: TCP
+      port: 6443
+  # CoreDNS — OCP uses port 5353 (not 53)
+  - ports:
+    - protocol: TCP
+      port: 5353
+    - protocol: UDP
+      port: 5353
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: openshift-dns
+{{- end }}
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index ee3fbc55..7e046a60 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -2,6 +2,18 @@
 
 This document describes recommended practices for developing and testing against this pattern.
 
+## Supported OCP Versions
+
+This pattern is tested and supported on the following OpenShift Container Platform versions:
+
+| OCP Stream | Status | Notes |
+|---|---|---|
+| **< 4.20** | Usupported | |
+| **4.20** | Supported | Tested and verified |
+| **4.21** | Supported | Tested and verified |
+
+Running the pattern on untested OCP versions may result in operator subscription failures or NetworkPolicy-related deployment issues.
+
 ## Testing Environments
 
 While you may bring your own (BYO) OpenShift cluster, Red Hat associates and partners may utilize [Red Hat Demo Platform (RHDP)](https://catalog.demo.redhat.com) to provision OpenShift environments for use as targets for pattern development and testing.