diff --git a/docs/network-policy/customize-network-policy.mdx b/docs/network-policy/customize-network-policy.mdx
index e3493f6e0f2..d51e4c4fb61 100644
--- a/docs/network-policy/customize-network-policy.mdx
+++ b/docs/network-policy/customize-network-policy.mdx
@@ -159,7 +159,8 @@ CONNECT tunnel failed, response 403
 This recipe applies only when URL-based MCP traffic uses the sandbox proxy and fails with that CONNECT 403 response.
 An OAuth MCP login failure such as `getaddrinfo EAI_AGAIN`, or any direct-DNS path that bypasses the proxy, is a separate transport problem and is not fixed by widening this allowlist.
 
-Add a preset with the MCP host, the exact Streamable HTTP MCP route, the HTTP methods that route uses (`GET` and `POST`), and only the process binary that opens the connection:
+Add a preset with the MCP host, the exact Streamable HTTP MCP route, the HTTP methods that route uses (`GET`, `POST`, and `DELETE`), and only the process binary that opens the connection.
+Streamable HTTP MCP clients can use `DELETE` on the same endpoint to terminate a session, so keep that method scoped to the exact MCP route instead of widening the path:
 
 ```yaml
 preset:
@@ -176,6 +177,7 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/mcp" }
           - allow: { method: POST, path: "/mcp" }
+          - allow: { method: DELETE, path: "/mcp" }
     binaries:
       - { path: /usr/local/bin/node }
 ```
diff --git a/test/policy-roundtrip-docs.test.ts b/test/policy-roundtrip-docs.test.ts
index e65bdc8ec1d..7fb0fdc3873 100644
--- a/test/policy-roundtrip-docs.test.ts
+++ b/test/policy-roundtrip-docs.test.ts
@@ -27,9 +27,11 @@ describe("policy round-trip documentation examples", () => {
     expect(section).toBeDefined();
     expect(section).toContain('- allow: { method: GET, path: "/mcp" }');
     expect(section).toContain('- allow: { method: POST, path: "/mcp" }');
+    expect(section).toContain('- allow: { method: DELETE, path: "/mcp" }');
     expect(section).not.toContain('path: "/**"');
     expect(section?.match(/- \{ path: \/usr\/local\/bin\//g)).toHaveLength(1);
     expect(section).toContain("only the process that opens the connection");
+    expect(section).toContain("terminate a session");
     expect(section).toContain("do not replace it with `/**`");
     expect(section).toContain("does not disable OpenShell's SSRF protection");
     expect(section).toContain("getaddrinfo EAI_AGAIN");