diff --git a/platform/kyverno/policies/validate-default-deny-shape.yaml b/platform/kyverno/policies/validate-default-deny-shape.yaml
index 8c693fa..e14c6ce 100644
--- a/platform/kyverno/policies/validate-default-deny-shape.yaml
+++ b/platform/kyverno/policies/validate-default-deny-shape.yaml
@@ -36,8 +36,12 @@ spec:
         message: >-
           A default-deny baseline NetworkPolicy must set spec.policyTypes to include
           BOTH Ingress and Egress (R-NET-01, docs/03).
-        pattern:
-          spec:
-            policyTypes:
-              - Ingress
-              - Egress
+        deny:
+          conditions:
+            any:
+              - key: Ingress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"
+              - key: Egress
+                operator: AnyNotIn
+                value: "{{ request.object.spec.policyTypes || `[]` }}"