diff --git a/lib/forgejo-stack.ts b/lib/forgejo-stack.ts
index 7629e90..33385d6 100644
--- a/lib/forgejo-stack.ts
+++ b/lib/forgejo-stack.ts
@@ -33,8 +33,10 @@ export class ForgejoStack extends cdk.Stack {
     });
 
     const albSg = ec2.SecurityGroup.fromSecurityGroupId(
-      this, "AlbSg", "sg-0b0301deed193258a"
+      this, "AlbSg", "sg-0b0301deed193258a",
+      { allowAllOutbound: false }
     );
+    albSg.addEgressRule(sg, ec2.Port.tcp(3000), "Forgejo HTTP");
     sg.addIngressRule(albSg, ec2.Port.tcp(3000), "HTTP from ALB");
     sg.addIngressRule(ec2.Peer.ipv4("10.20.0.0/16"), ec2.Port.tcp(3000), "HTTP from VPC");
     sg.addIngressRule(ec2.Peer.ipv4("10.10.0.0/16"), ec2.Port.tcp(3000), "HTTP from office VPN");