diff --git a/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml b/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml
new file mode 100644
index 0000000..dd2131c
--- /dev/null
+++ b/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml
@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: deny-external-token-endpoints
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  action: DENY
+  rules:
+    - to:
+        - operation:
+            paths:
+              - /api/token/user/*
+              - /internal/*
diff --git a/infrastructure/istio-config/yc-k8s-test/kustomization.yaml b/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
index 894c51a..f5072f8 100644
--- a/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
+++ b/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - deny-token-endpoints.yaml
 patches:
   - path: istio-config.yaml