diff --git a/management/internals/shared/grpc/components_encoder.go b/management/internals/shared/grpc/components_encoder.go
index 786c39f1d..8d2ecbba4 100644
--- a/management/internals/shared/grpc/components_encoder.go
+++ b/management/internals/shared/grpc/components_encoder.go
@@ -189,6 +189,9 @@ func (e *componentEncoder) indexRouterPeers(routers map[string]*nbpeer.Peer) []u
 
 func (e *componentEncoder) indexAllNetworkResources() {
 	for _, r := range e.components.NetworkResources {
+		if !r.Enabled {
+			continue
+		}
 		e.networkIdToPublicId[r.ID] = r.PublicID
 	}
 }
@@ -361,7 +364,7 @@ func (e *componentEncoder) resourceToProto(r types.Resource) *proto.ResourceComp
 		}
 	}
 
-	publicID, ok := e.networkIdToPublicId[r.ID]
+	publicID, ok := e.networkPublicId(r.ID)
 	if !ok {
 		return nil
 	}
diff --git a/shared/management/networkmap/decode.go b/shared/management/networkmap/decode.go
index b46e8144d..dce7d7f81 100644
--- a/shared/management/networkmap/decode.go
+++ b/shared/management/networkmap/decode.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"slices"
 	"strconv"
 	"time"
 
@@ -178,14 +179,12 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	}
 
 	// Phase 8: rebuild resource_policies_map
-	for _, p := range c.Policies {
-		rule := p.Rules[0] // there's always only one rule
-		if rule.SourceResource.Type != types.ResourceTypePeer && rule.SourceResource.ID != "" {
-			c.ResourcePoliciesMap[rule.SourceResource.ID] = append(c.ResourcePoliciesMap[rule.SourceResource.ID], p)
-		}
-		if rule.SourceResource.Type != types.ResourceTypePeer && rule.DestinationResource.Type != "" {
-			c.ResourcePoliciesMap[rule.SourceResource.ID] = append(c.ResourcePoliciesMap[rule.SourceResource.ID], p)
+	for _, r := range c.NetworkResources {
+		policies := policiesForNetworkResource(r.ID, c.Policies, c.Groups)
+		if len(policies) == 0 {
+			continue
 		}
+		c.ResourcePoliciesMap[r.ID] = policies
 	}
 
 	// Phase 9: group_id_to_user_ids — wire keys are seq ids, synth to strings.
@@ -223,6 +222,43 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	return c, nil
 }
 
+func networkResourceGroups(resourceId string, groups map[string]*types.Group) []string {
+	var toret []string
+	for _, group := range groups {
+		for _, resource := range group.Resources {
+			if resource.ID == resourceId {
+				toret = append(toret, resourceId)
+			}
+		}
+	}
+	return toret
+}
+
+func policiesForNetworkResource(resourceId string, allPolicies []*types.Policy, groups map[string]*types.Group) []*types.Policy {
+	var toret []*types.Policy
+
+	networkResourceGroups := networkResourceGroups(resourceId, groups)
+	for _, p := range allPolicies {
+		if p == nil || !p.Enabled {
+			continue
+		}
+
+		// there's always only one rule in each policy
+		if p.Rules[0].DestinationResource.ID == resourceId {
+			toret = append(toret, p)
+			continue
+		}
+		for _, groupId := range networkResourceGroups {
+			if slices.Contains(p.Rules[0].Destinations, groupId) {
+				toret = append(toret, p)
+				break
+			}
+		}
+	}
+
+	return toret
+}
+
 func decodeAccountNetwork(an *proto.AccountNetwork) *types.Network {
 	if an == nil {
 		return nil