diff --git a/pkg/controller/audit/actuator.go b/pkg/controller/audit/actuator.go
index a7feb17..5471ff8 100644
--- a/pkg/controller/audit/actuator.go
+++ b/pkg/controller/audit/actuator.go
@@ -685,6 +685,8 @@ func seedObjects(auditConfig *v1alpha1.AuditConfig, secrets map[string]*corev1.S
 		}
 
 		if cluster.Shoot.Spec.ControlPlane != nil && cluster.Shoot.Spec.ControlPlane.HighAvailability != nil {
+			vpnGateway.Spec.Template.Labels["networking.resources.gardener.cloud/to-vpn-seed-server-0-tcp-9443"] = "allowed"
+
 			vpnGateway.Spec.Template.Spec.Containers[0].Env = append(vpnGateway.Spec.Template.Spec.Containers[0].Env,
 				corev1.EnvVar{
 					Name:  "GATEWAY_PROXY_HOST",