diff --git a/docs/ai-coder/boundary/agent-boundary.md b/docs/ai-coder/boundary/agent-boundary.md
index 815a271a98..5c0ff253c8 100644
--- a/docs/ai-coder/boundary/agent-boundary.md
+++ b/docs/ai-coder/boundary/agent-boundary.md
@@ -31,18 +31,22 @@ module "claude-code" {
 }
 ```
 
-Create a `config.yaml` file in your template directory with your policy:
+Create a `config.yaml` file in your template directory with your policy. For the Claude Code module, use the following minimal configuration:
 
 ```yaml
 allowlist:
-  - "domain=google.com"
-  - "method=GET,HEAD domain=api.github.com"
-  - "method=POST domain=api.example.com path=/users,/posts"
+  - "domain=dev.coder.com"              # Required - use your Coder deployment domain
+  - "domain=api.anthropic.com"          # Required - API endpoint for Claude
+  - "domain=statsig.anthropic.com"      # Required - Feature flags and analytics
+  - "domain=claude.ai"                  # Recommended - WebFetch/WebSearch features
+  - "domain=*.sentry.io"                # Recommended - Error tracking (helps Anthropic fix bugs)
 log_dir: /tmp/boundary_logs
 proxy_port: 8087
 log_level: warn
 ```
 
+For a basic recommendation of what to allow for agents, see the [Anthropic documentation on default allowed domains](https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains). For a comprehensive example of a production Boundary configuration, see the [Coder dogfood policy example](https://github.com/coder/coder/blob/main/dogfood/coder/boundary-config.yaml).
+
 Add a `coder_script` resource to mount the configuration file into the workspace filesystem:
 
 ```tf
diff --git a/dogfood/coder/boundary-config.yaml b/dogfood/coder/boundary-config.yaml
index 400882f3b1..957cf82b40 100644
--- a/dogfood/coder/boundary-config.yaml
+++ b/dogfood/coder/boundary-config.yaml
@@ -1,16 +1,14 @@
 allowlist:
-  # specified in claude-code module as well (effectively a duplicate); needed for basic functionality of claude-code agent
-  - domain=anthropic.com
-  - domain=registry.npmjs.org
-  - domain=sentry.io
-  - domain=claude.ai
+  # Test domains
+  - method=GET domain=typicode.com
+  - method=GET domain=*.typicode.com
+
+  # Coder Dogfood Deployment
   - domain=dev.coder.com
 
-  # test domains
-  - method=GET domain=typicode.com
-
-  # domain used in coder task workspaces
+  # Domain used in coder workspaces
   - method=POST domain=http-intake.logs.datadoghq.com
+  - method=POST domain=http-intake.logs.us5.datadoghq.com
 
   # Default allowed domains from Claude Code on the web
   # Source: https://code.claude.com/docs/en/claude-code-on-the-web#default-allowed-domains
diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 38524f05c0..db4dbc6011 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -888,7 +888,7 @@ resource "coder_script" "boundary_config_setup" {
 module "claude-code" {
   count               = data.coder_task.me.enabled ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "4.3.0"
+  version             = "4.4.2"
   enable_boundary     = true
   boundary_version    = "v0.5.5"
   agent_id            = coder_agent.dev.id