diff --git a/.github/workflows/combine_deploy_image.yml b/.github/workflows/combine_deploy_image.yml
index fc9c3afd35..65e0458a21 100644
--- a/.github/workflows/combine_deploy_image.yml
+++ b/.github/workflows/combine_deploy_image.yml
@@ -31,6 +31,7 @@ jobs:
             get.helm.sh:443
             github.com:443
             production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             public.ecr.aws:443
             pypi.org:443
             raw.githubusercontent.com:443
diff --git a/.github/workflows/deploy_qa.yml b/.github/workflows/deploy_qa.yml
index 00c0dbc52c..b94adbbbed 100644
--- a/.github/workflows/deploy_qa.yml
+++ b/.github/workflows/deploy_qa.yml
@@ -51,6 +51,7 @@ jobs:
             github.com:443
             mcr.microsoft.com:443
             production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             public.ecr.aws:443
             pypi.org:443
             registry-1.docker.io:443
diff --git a/.github/workflows/deploy_release.yml b/.github/workflows/deploy_release.yml
index 16fc85af24..91095b669c 100644
--- a/.github/workflows/deploy_release.yml
+++ b/.github/workflows/deploy_release.yml
@@ -38,6 +38,7 @@ jobs:
             github.com:443
             mcr.microsoft.com:443
             production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             public.ecr.aws:443
             pypi.org:443
             registry-1.docker.io:443
diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml
index d9a0bf78ec..7af6f92843 100644
--- a/.github/workflows/maintenance.yml
+++ b/.github/workflows/maintenance.yml
@@ -28,13 +28,10 @@ jobs:
           allowed-endpoints: >
             *.cloudfront.net:443
             archive.ubuntu.com:80
-            auth.docker.io:443
             files.pythonhosted.org:443
             github.com:443
-            production.cloudflare.docker.com:443
             public.ecr.aws:443
             pypi.org:443
-            registry-1.docker.io:443
             security.ubuntu.com:80
       # For subfolders, currently a full checkout is required.
       # See: https://github.com/marketplace/actions/build-and-push-docker-images#path-context