diff --git a/infra/deploy-runner/nodedc-deploy b/infra/deploy-runner/nodedc-deploy
index f02a26a..7cc7812 100755
--- a/infra/deploy-runner/nodedc-deploy
+++ b/infra/deploy-runner/nodedc-deploy
@@ -23878,7 +23878,13 @@ def run_healthchecks(component, entries=None, services=None):
             )
         for check in component_healthchecks(component, entries, services):
             healthcheck_url(check)
-        validate_device_manager_control_plane_runtime()
+        if is_device_plane_manager_release_v3_slice(component, entries):
+            validate_device_manager_control_plane_runtime(
+                require_edge_channel=True,
+                core_network_mode="private-egress",
+            )
+        else:
+            validate_device_manager_control_plane_runtime()
         return
     if is_device_plane_edge_core_channel_bootstrap_slice(component, entries):
         if tuple(services or ()) != ("device-control-core",):
diff --git a/infra/deploy-runner/test_device_plane_registry.py b/infra/deploy-runner/test_device_plane_registry.py
index 95bb259..a57cc38 100644
--- a/infra/deploy-runner/test_device_plane_registry.py
+++ b/infra/deploy-runner/test_device_plane_registry.py
@@ -268,6 +268,33 @@ class DevicePlaneRegistryTest(unittest.TestCase):
             ],
         )
 
+    def test_manager_v3_post_apply_uses_private_egress_core_boundary(self):
+        with (
+            mock.patch.object(
+                RUNNER,
+                "healthcheck_compose_service_with_grace",
+            ),
+            mock.patch.object(
+                RUNNER,
+                "component_healthchecks",
+                return_value=(),
+            ),
+            mock.patch.object(
+                RUNNER,
+                "validate_device_manager_control_plane_runtime",
+            ) as runtime_acceptance,
+        ):
+            RUNNER.run_healthchecks(
+                "device-plane",
+                RUNNER.DEVICE_PLANE_MANAGER_RELEASE_V3_ENTRIES,
+                ("device-manager",),
+            )
+
+        runtime_acceptance.assert_called_once_with(
+            require_edge_channel=True,
+            core_network_mode="private-egress",
+        )
+
     def test_manager_predecessor_health_is_phase_scoped(self):
         with self.assertRaisesRegex(
             RUNNER.DeployError,