diff --git a/cmd/client/main.go b/cmd/client/main.go
index a1767ab..ad952fa 100644
--- a/cmd/client/main.go
+++ b/cmd/client/main.go
@@ -579,7 +579,8 @@ func (g *Game) DrawMenu(screen *ebiten.Image) {
 	coopX := ScreenWidth/2 + 20
 	vector.DrawFilledRect(screen, float32(coopX), float32(btnY), float32(btnW), float32(btnH), ColBtnNormal, false)
 	vector.StrokeRect(screen, float32(coopX), float32(btnY), float32(btnW), float32(btnH), 2, color.White, false)
-	text.Draw(screen, "CO-OP (Host)", basicfont.Face7x13, coopX+45, btnY+35, ColText)
+	text.Draw(screen, "CO-OP (Host)", basicfont.Face7x13, coopX+45, btnY+30, ColText)
+	text.Draw(screen, "(EXPERIMENTAL)", basicfont.Face7x13, coopX+45, btnY+45, color.RGBA{255, 68, 68, 255})
 
 	// Join Section
 	joinY := ScreenHeight/2 + 100
@@ -641,7 +642,7 @@ func (g *Game) DrawLobby(screen *ebiten.Image) {
 	screen.Fill(color.RGBA{20, 20, 30, 255})
 
 	// Titel
-	text.Draw(screen, "LOBBY", basicfont.Face7x13, ScreenWidth/2-20, 80, ColText)
+	text.Draw(screen, "LOBBY (EXPERIMENTAL)", basicfont.Face7x13, ScreenWidth/2-80, 80, color.RGBA{255, 68, 68, 255})
 
 	// Room Code (groß anzeigen)
 	text.Draw(screen, "Room Code:", basicfont.Face7x13, ScreenWidth/2-40, 150, color.Gray{200})
diff --git a/cmd/client/web/index.html b/cmd/client/web/index.html
index ec927da..ed552eb 100644
--- a/cmd/client/web/index.html
+++ b/cmd/client/web/index.html
@@ -29,7 +29,7 @@
                 <input type="text" id="playerName" placeholder="NAME (4 ZEICHEN)" maxlength="15" style="text-transform:uppercase;">
 
                 <button id="startBtn" onclick="startSoloGame()" disabled style="opacity: 0.5; cursor: not-allowed;">SOLO STARTEN</button>
-                <button id="coopBtn" onclick="showCoopMenu()" disabled style="opacity: 0.5; cursor: not-allowed;">CO-OP SPIELEN</button>
+                <button id="coopBtn" onclick="showCoopMenu()" disabled style="opacity: 0.5; cursor: not-allowed;">CO-OP SPIELEN <span style="font-size: 8px; color: #ff4444;">(EXPERIMENTAL)</span></button>
 
                 <div class="info-box">
                     <div class="info-title">SCHUL-NEWS</div>
@@ -73,7 +73,7 @@
     <!-- CO-OP MENU -->
     <div id="coopMenu" class="overlay-screen hidden">
         <div class="center-box">
-            <h1>CO-OP MODUS</h1>
+            <h1>CO-OP MODUS <span style="font-size: 12px; color: #ff4444; vertical-align: middle;">(EXPERIMENTAL)</span></h1>
 
             <button id="createRoomBtn" class="big-btn" onclick="createRoom()" disabled style="opacity: 0.5; cursor: not-allowed;">RAUM ERSTELLEN</button>
 
@@ -242,7 +242,7 @@
     <!-- LOBBY SCREEN (CO-OP WAITING ROOM) -->
     <div id="lobbyScreen" class="overlay-screen hidden">
         <div class="center-box">
-            <h1>LOBBY</h1>
+            <h1>LOBBY <span style="font-size: 12px; color: #ff4444; vertical-align: middle;">(EXPERIMENTAL)</span></h1>
 
             <div id="lobbyContent" style="display: flex; gap: 20px; width: 100%; justify-content: center; align-items: flex-start;">
                 <div style="flex: 1; max-width: 400px;">
diff --git a/k8s/cilium-netpol.yaml b/k8s/cilium-netpol.yaml
index 555368d..197e95a 100644
--- a/k8s/cilium-netpol.yaml
+++ b/k8s/cilium-netpol.yaml
@@ -125,3 +125,36 @@ spec:
     - ports:
       - port: "6222"
         protocol: TCP
+---
+# ACME Challenge Solver Network Policy
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: acme-solver-netpol
+  namespace: ${TARGET_NS}
+spec:
+  endpointSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  ingress:
+  # Allow ingress from Traefik
+  - fromEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: traefik
+    toPorts:
+    - ports:
+      - port: "8089"
+        protocol: TCP
+  egress:
+  # Allow egress to internet for self-check (if needed) and DNS
+  - toEntities:
+    - world
+  - toEndpoints:
+    - matchLabels:
+        k8s:io.kubernetes.pod.namespace: kube-system
+        k8s-app: kube-dns
+    toPorts:
+    - ports:
+      - port: "53"
+        protocol: UDP
+