diff --git a/config/kpack.yml b/config/kpack.yml
index c05780493..aac1db514 100644
--- a/config/kpack.yml
+++ b/config/kpack.yml
@@ -3,3 +3,16 @@
 
 #@ kpack = library.get("github.com/pivotal/kpack")
 --- #@ template.replace(kpack.eval())
+--- #! explanation: the blobstore's sidecar needs to accept plain text connections from kpack build init containers.
+    #! see https://github.com/cloudfoundry/capi-k8s-release/issues/12
+apiVersion: "authentication.istio.io/v1alpha1"
+kind: "Policy"
+metadata:
+  name: "cf-blobstore-allow-plaintext"
+  namespace: "cf-blobstore"
+spec:
+  targets:
+  - name: cf-blobstore-minio
+  peers:
+  - mtls:
+      mode: PERMISSIVE