diff --git a/manifests/function/network-policy/calico/calico-policy-cleanup/cleanup-calico-policy.yaml b/manifests/function/network-policy/calico/calico-policy-cleanup/cleanup-calico-policy.yaml
new file mode 100644
index 000000000..376d0843d
--- /dev/null
+++ b/manifests/function/network-policy/calico/calico-policy-cleanup/cleanup-calico-policy.yaml
@@ -0,0 +1,12 @@
+apiVersion: builtin
+kind: PatchTransformer
+metadata:
+  name: delete-treasuremap-policy.yaml
+target:
+ kind: GlobalNetworkPolicy
+patch: |
+  apiVersion: not-important
+  kind: not-important
+  metadata:
+    name: hosts-ingress-rule
+  $patch: delete
diff --git a/manifests/function/network-policy/calico/calico-policy-cleanup/kustomization.yaml b/manifests/function/network-policy/calico/calico-policy-cleanup/kustomization.yaml
new file mode 100644
index 000000000..575cf23a0
--- /dev/null
+++ b/manifests/function/network-policy/calico/calico-policy-cleanup/kustomization.yaml
@@ -0,0 +1,4 @@
+# Prevent policies from being deployed into downstream
+
+resources:
+  - cleanup-calico-policy.yaml