diff --git a/nemoclaw-blueprint/policies/presets/telegram.yaml b/nemoclaw-blueprint/policies/presets/telegram.yaml
index 55a2fdfb0e3..2a9e1167931 100644
--- a/nemoclaw-blueprint/policies/presets/telegram.yaml
+++ b/nemoclaw-blueprint/policies/presets/telegram.yaml
@@ -12,6 +12,7 @@ network_policies:
       - host: api.telegram.org
         port: 443
         protocol: rest
+        tls: terminate
         enforcement: enforce
         rules:
           - allow: { method: GET, path: "/bot*/**" }
diff --git a/test/policies.test.ts b/test/policies.test.ts
index f95ae34f1ef..1f304f39757 100644
--- a/test/policies.test.ts
+++ b/test/policies.test.ts
@@ -606,14 +606,28 @@ describe("policies", () => {
       }
     });
 
-    it("messaging REST presets do not pin deprecated tls termination", () => {
-      for (const name of ["discord", "slack", "telegram"]) {
-        const content = policies.loadPreset(name);
+    it("messaging WebSocket presets keep tls: skip on gateway endpoints", () => {
+      const cases = [
+        { preset: "discord", pattern: /host:\s*gateway\.discord\.gg[\s\S]*?tls:\s*skip/ },
+        { preset: "slack", pattern: /host:\s*wss-primary\.slack\.com[\s\S]*?tls:\s*skip/ },
+        { preset: "slack", pattern: /host:\s*wss-backup\.slack\.com[\s\S]*?tls:\s*skip/ },
+      ];
+
+      for (const { preset, pattern } of cases) {
+        const content = policies.loadPreset(preset);
         expect(content).toBeTruthy();
-        expect(content.includes("tls: terminate")).toBe(false);
+        expect(content).toMatch(pattern);
       }
     });
 
+    it("telegram REST preset uses tls: terminate for L7 proxy", () => {
+      const content = policies.loadPreset("telegram");
+      expect(content).toBeTruthy();
+      expect(content).toMatch(
+        /host:\s*api\.telegram\.org[\s\S]*?protocol:\s*rest[\s\S]*?tls:\s*terminate/,
+      );
+    });
+
     it("pypi preset allows HEAD for pip lazy-wheel metadata checks", () => {
       // pip and uv use HEAD requests for lazy wheel downloads and
       // range-request support. GET-only would break pip install.