diff --git a/spec.yaml b/spec.yaml
index 7aba20c..da79579 100644
--- a/spec.yaml
+++ b/spec.yaml
@@ -10,8 +10,10 @@ licenses:
 permissions:
   network:
     allow:
-      # Kernel REST API and regional CDP WebSocket proxy hosts.
-      - '*.onkernel.com'
+      # Kernel REST API and regional proxy-based CDP endpoints.
+      - '**.onkernel.com'
+      # Direct CDP endpoints returned by Kernel in some metros.
+      - '*.kernel.sh'
       # Package registries used when agents add a Kernel SDK.
       - registry.npmjs.org
       - '*.npmjs.org'
@@ -22,6 +24,10 @@ permissions:
       - objects.githubusercontent.com
       - release-assets.githubusercontent.com
 
+environment:
+  variables:
+    KERNEL_NO_UPDATE_CHECK: "1"
+
 credentials:
   - service: kernel
     description: Kernel API key