diff --git a/kubernetes/devnet-7/faucet-agents/values.yaml b/kubernetes/devnet-7/faucet-agents/values.yaml
index 0f49c83..5f48a22 100644
--- a/kubernetes/devnet-7/faucet-agents/values.yaml
+++ b/kubernetes/devnet-7/faucet-agents/values.yaml
@@ -20,6 +20,12 @@ powfaucet:
     enabled: true
 
     className: ingress-nginx-public
+    annotations:
+      # Lock the faucet behind basic auth that only the panda proxy holds, so it
+      # is reachable solely via the proxy (which authenticates the caller first).
+      nginx.ingress.kubernetes.io/auth-type: basic
+      nginx.ingress.kubernetes.io/auth-secret: powfaucet-agents-basic-auth
+      nginx.ingress.kubernetes.io/auth-realm: "panda proxy only"
 
     hosts:
       - host: faucet-agents.glamsterdam-devnet-7.ethpandaops.io