diff --git a/.changes/unreleased/Feature-20260910-093000.yaml b/.changes/unreleased/Feature-20260910-093000.yaml
new file mode 100644
index 0000000..1e30c53
--- /dev/null
+++ b/.changes/unreleased/Feature-20260910-093000.yaml
@@ -0,0 +1,5 @@
+kind: Feature
+body: Add `opslevel.ssrfAllowedIpRanges` so self-hosted operators can allow-list internal
+  IPs/CIDRs that custom integrations and webhooks need to reach, rendered into
+  `SSRF_ALLOWED_IP_RANGES`
+time: 2026-09-10T09:30:00.000000-04:00
diff --git a/.gitignore b/.gitignore
index b31ff3b..3186971 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,8 @@
 .idea
 /manifests
 rendered
+# Stray chart tarballs from a manual `helm pull` in the repo root. Anchored so the
+# vendored subcharts under charts/*/charts/ stay tracked and visible in git status.
+/*.tgz
+# `task pull-self-hosted` untars the published chart here
+/downloads
diff --git a/charts/opslevel/templates/opslevel/configmap.yaml b/charts/opslevel/templates/opslevel/configmap.yaml
index 307f4bf..cd28cff 100644
--- a/charts/opslevel/templates/opslevel/configmap.yaml
+++ b/charts/opslevel/templates/opslevel/configmap.yaml
@@ -51,6 +51,7 @@ data:
   SMTP_PORT: '{{ .Values.smtp.secret.port }}'
   SMTP_USERNAME: '{{ .Values.smtp.secret.username }}'
   SORBET_RUNTIME_DEFAULT_CHECKED_LEVEL: 'never'
+  SSRF_ALLOWED_IP_RANGES: '{{ join "," .Values.opslevel.ssrfAllowedIpRanges }}'
   THROTTLE_GRAPHQL_LIMIT: '250'
   THROTTLER_ENABLED: 'true'
   TRANSACTIONAL_OUTBOX_ENABLED: '{{ .Values.opssight.enabled }}'
diff --git a/charts/opslevel/values.yaml b/charts/opslevel/values.yaml
index 1da65fc..768c16e 100644
--- a/charts/opslevel/values.yaml
+++ b/charts/opslevel/values.yaml
@@ -37,6 +37,13 @@ opslevel:
   domain: "example.com"
   subdomain: "self-hosted"
   forceSSL: false
+  # Internal destinations the app is allowed to reach when making outbound requests
+  # on a user-supplied URL -- custom action webhooks, custom integration extractors.
+  # Private, loopback, link-local and cloud-metadata addresses are blocked by default;
+  # list an IP ("10.1.2.3") or CIDR range ("10.0.0.0/8") here to carve one back out.
+  # Rendered into SSRF_ALLOWED_IP_RANGES, which web, workers and the scheduler all
+  # read at startup -- changing it restarts them.
+  ssrfAllowedIpRanges: []
   image:
     repository: "746108190720.dkr.ecr.us-east-1.amazonaws.com/opslevel"
     tag: "selfhosted-prod-8de7ca42-1786633441"