diff --git a/docs/ai-coder/boundary/rules-engine.md b/docs/ai-coder/boundary/rules-engine.md
index 3f1a6f4f19..319a857963 100644
--- a/docs/ai-coder/boundary/rules-engine.md
+++ b/docs/ai-coder/boundary/rules-engine.md
@@ -23,8 +23,9 @@ Rules follow the format: `key=value [key=value ...]` with three supported keys:
 
 ```yaml
 allowlist:
-  - domain=github.com                                  # All methods, all paths for github.com
-  - method=GET,POST domain=api.example.com             # GET/POST to api.example.com
+  - domain=github.com                                  # All methods, all paths for github.com (exact match)
+  - domain=*.github.com                                # All subdomains of github.com
+  - method=GET,POST domain=api.example.com             # GET/POST to api.example.com (exact match)
   - domain=api.example.com path=/users,/posts          # Multiple paths
   - method=GET domain=github.com path=/api/*           # All three keys
 ```
@@ -35,19 +36,20 @@ allowlist:
 
 The `*` wildcard matches domain labels (parts separated by dots).
 
-| Pattern        | Matches                                                          | Does NOT Match                                                           |
-|----------------|------------------------------------------------------------------|--------------------------------------------------------------------------|
-| `*`            | All domains                                                      | -                                                                        |
-| `github.com`   | `github.com`, `api.github.com`, `v1.api.github.com` (subdomains) | `github.io` (diff domain)                                                |
-| `*.github.com` | `api.github.com`, `v1.api.github.com` (1+ subdomain levels)      | `github.com` (base domain)                                               |
-| `api.*.com`    | `api.github.com`, `api.google.com`                               | `api.v1.github.com` (`*` in the middle matches exactly one domain label) |
-| `*.*.com`      | `api.example.com`, `api.v1.github.com`                           | -                                                                        |
-| `api.*`        | ❌ **ERROR** - Cannot end with `*`                                | -                                                                        |
+| Pattern        | Matches                                                     | Does NOT Match                                                           |
+|----------------|-------------------------------------------------------------|--------------------------------------------------------------------------|
+| `*`            | All domains                                                 | -                                                                        |
+| `github.com`   | `github.com` (exact match only)                             | `api.github.com`, `v1.api.github.com` (subdomains), `github.io`          |
+| `*.github.com` | `api.github.com`, `v1.api.github.com` (1+ subdomain levels) | `github.com` (base domain)                                               |
+| `api.*.com`    | `api.github.com`, `api.google.com`                          | `api.v1.github.com` (`*` in the middle matches exactly one domain label) |
+| `*.*.com`      | `api.example.com`, `api.v1.github.com`                      | -                                                                        |
+| `api.*`        | ❌ **ERROR** - Cannot end with `*`                           | -                                                                        |
 
 **Important**:
 
-- Patterns without `*` at the start automatically match subdomains
+- Patterns without `*` match **exactly** (no automatic subdomain matching)
 - `*.example.com` matches one or more subdomain levels
+- To match both base domain and subdomains, use separate rules: `domain=github.com` and `domain=*.github.com`
 - Domain patterns **cannot end with asterisk**
 
 ---
diff --git a/dogfood/coder/boundary-config.yaml b/dogfood/coder/boundary-config.yaml
index 2b6c412a36..400882f3b1 100644
--- a/dogfood/coder/boundary-config.yaml
+++ b/dogfood/coder/boundary-config.yaml
@@ -7,7 +7,6 @@ allowlist:
   - domain=dev.coder.com
 
   # test domains
-  - method=GET domain=google.com
   - method=GET domain=typicode.com
 
   # domain used in coder task workspaces
diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index a0f157663c..38524f05c0 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -890,7 +890,7 @@ module "claude-code" {
   source              = "dev.registry.coder.com/coder/claude-code/coder"
   version             = "4.3.0"
   enable_boundary     = true
-  boundary_version    = "v0.5.2"
+  boundary_version    = "v0.5.5"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"