diff --git a/src/compose-generator.test.ts b/src/compose-generator.test.ts
index 7595afa89..1c4ad642d 100644
--- a/src/compose-generator.test.ts
+++ b/src/compose-generator.test.ts
@@ -285,6 +285,23 @@ describe('generateDockerCompose', () => {
         expect(squidNetworks['awf-ext']).toBeDefined();
       });
 
+      it('keeps cli-proxy on awf-net only when it targets an attached DIFC proxy', () => {
+        const config = {
+          ...mockConfig,
+          networkIsolation: true,
+          difcProxyHost: 'awmg-cli-proxy:18443',
+        };
+        const networkWithCliProxy = {
+          ...mockNetworkConfig,
+          cliProxyIp: '172.30.0.50',
+        };
+        const result = generateDockerCompose(config, networkWithCliProxy);
+
+        const cliProxyNetworks = result.services['cli-proxy'].networks as { [key: string]: { ipv4_address?: string } };
+        expect(cliProxyNetworks['awf-net'].ipv4_address).toBe('172.30.0.50');
+        expect(cliProxyNetworks['awf-ext']).toBeUndefined();
+      });
+
       it('should keep the agent on awf-net only (no external network)', () => {
         const result = generateDockerCompose({ ...mockConfig, networkIsolation: true }, mockNetworkConfig);