diff --git a/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml b/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml
index d723ab08..479f645b 100644
--- a/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml
+++ b/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml
@@ -21,6 +21,7 @@ spec:
       labels:
         networking.gardener.cloud/to-dns: allowed
         networking.resources.gardener.cloud/to-virtual-garden-kube-apiserver-tcp-443: allowed
+        networking.gardener.cloud/to-runtime-apiserver: allowed
 {{ include "labels" . | indent 8 }}
     spec:
       serviceAccountName: {{ include "name" . }}