diff --git a/test/e2e/live/network-policy.test.ts b/test/e2e/live/network-policy.test.ts
index fd3cd60b8c5..bbd11fe6566 100644
--- a/test/e2e/live/network-policy.test.ts
+++ b/test/e2e/live/network-policy.test.ts
@@ -637,6 +637,16 @@ test("network-policy: restricted sandbox enforces live allow/deny policy probes"
   });
   expect(connectProbe.exitCode, text(connectProbe)).toBe(0);
 
+  const brewGitDenied = await sandboxBash(
+    sandbox,
+    "GIT_TERMINAL_PROMPT=0 git ls-remote https://github.com/Homebrew/brew.git HEAD >/dev/null",
+    { artifactName: "tc-net-11-brew-git-denied" },
+  );
+  const brewGitDeniedText = text(brewGitDenied);
+  expect(brewGitDenied.timedOut, brewGitDeniedText).toBe(false);
+  expect(brewGitDenied.exitCode, brewGitDeniedText).not.toBe(0);
+  expect(brewGitDeniedText).toMatch(/\b403\b|denied|forbidden/i);
+
   const brewProbe = await sandboxBash(
     sandbox,
     String.raw`
@@ -654,8 +664,6 @@ check_status() {
 }
 check_status formulae https://formulae.brew.sh
 check_status raw https://raw.githubusercontent.com/Homebrew/brew/HEAD/README.md
-git ls-remote https://github.com/Homebrew/brew.git HEAD >/dev/null
-echo "BREW_ENDPOINT_github_OK"
 check_status ghcr https://ghcr.io/v2/
 command -v brew
 brew --prefix
@@ -668,13 +676,28 @@ hello
   const brewText = text(brewProbe);
   expect(brewText).toContain("BREW_ENDPOINT_formulae_OK_");
   expect(brewText).toContain("BREW_ENDPOINT_raw_OK_");
-  expect(brewText).toContain("BREW_ENDPOINT_github_OK");
   expect(brewText).toContain("BREW_ENDPOINT_ghcr_OK_");
   expect(brewText).toContain("/usr/local/bin/brew");
   expect(brewText).toContain("/home/linuxbrew/.linuxbrew");
   expect(brewText).toContain("/home/linuxbrew/.linuxbrew/bin/hello");
   expect(brewText).toContain("Hello, world!");
 
+  const githubApply = await applyPreset(host, "github");
+  expect(githubApply.exitCode, text(githubApply)).toBe(0);
+  const githubGitProbe = await sandboxBash(
+    sandbox,
+    String.raw`
+set -euo pipefail
+GIT_TERMINAL_PROMPT=0 git ls-remote https://github.com/Homebrew/brew.git HEAD >/dev/null
+echo "GITHUB_GIT_OK"
+`,
+    { artifactName: "tc-net-11-github-git-allowed" },
+  );
+  const githubGitText = text(githubGitProbe);
+  expect(githubGitProbe.timedOut, githubGitText).toBe(false);
+  expect(githubGitProbe.exitCode, githubGitText).toBe(0);
+  expect(githubGitText).toContain("GITHUB_GIT_OK");
+
   const pypiApply = await applyPreset(host, "pypi");
   expect(pypiApply.exitCode, text(pypiApply)).toBe(0);
   await expect(
diff --git a/test/pr-risk-plan.test.ts b/test/pr-risk-plan.test.ts
index fb242f4b214..d238e15560c 100644
--- a/test/pr-risk-plan.test.ts
+++ b/test/pr-risk-plan.test.ts
@@ -90,6 +90,11 @@ describe("deterministic PR risk plan", () => {
       family: "inference-policy",
       jobs: ["inference-routing", "network-policy"],
     },
+    {
+      file: "nemoclaw-blueprint/policies/presets/brew.yaml",
+      family: "inference-policy",
+      jobs: ["inference-routing", "network-policy"],
+    },
     {
       file: "src/lib/messaging/applier/agent-config.ts",
       family: "messaging-lifecycle",