diff --git a/actions/setup/js/firewall_blocked_domains.cjs b/actions/setup/js/firewall_blocked_domains.cjs
index b59db45769a..6432ecb1da3 100644
--- a/actions/setup/js/firewall_blocked_domains.cjs
+++ b/actions/setup/js/firewall_blocked_domains.cjs
@@ -192,6 +192,19 @@ function generateBlockedDomainsSection(blockedDomains) {
     section += `> - \`${domain}\`\n`;
   }
 
+  section += `>\n`;
+  section += `> To allow these domains, add them to the \`network.allowed\` list in your workflow frontmatter:\n`;
+  section += `>\n`;
+  section += `> \`\`\`yaml\n`;
+  section += `> network:\n`;
+  section += `>   allowed:\n`;
+  section += `>     - defaults\n`;
+  for (const domain of blockedDomains) {
+    section += `>     - "${domain}"\n`;
+  }
+  section += `> \`\`\`\n`;
+  section += `>\n`;
+  section += `> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.\n`;
   section += `>\n`;
   section += `> </details>\n`;
 
diff --git a/actions/setup/js/firewall_blocked_domains.test.cjs b/actions/setup/js/firewall_blocked_domains.test.cjs
index 78afee296af..f809374c460 100644
--- a/actions/setup/js/firewall_blocked_domains.test.cjs
+++ b/actions/setup/js/firewall_blocked_domains.test.cjs
@@ -263,6 +263,8 @@ describe("firewall_blocked_domains.cjs", () => {
       expect(result).toContain("> <summary>⚠️ Firewall blocked 1 domain</summary>");
       expect(result).toContain("> - `blocked.example.com`");
       expect(result).toContain("> The following domain was blocked by the firewall during workflow execution:");
+      expect(result).toContain('> ```yaml\n> network:\n>   allowed:\n>     - defaults\n>     - "blocked.example.com"\n> ```');
+      expect(result).toContain("> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.");
     });
 
     it("should generate details section for multiple blocked domains", () => {
@@ -276,6 +278,8 @@ describe("firewall_blocked_domains.cjs", () => {
       expect(result).toContain("> - `alpha.example.com`");
       expect(result).toContain("> - `beta.example.com`");
       expect(result).toContain("> - `gamma.example.com`");
+      expect(result).toContain('> ```yaml\n> network:\n>   allowed:\n>     - defaults\n>     - "alpha.example.com"\n>     - "beta.example.com"\n>     - "gamma.example.com"\n> ```');
+      expect(result).toContain("> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.");
     });
 
     it("should use correct singular/plural form", () => {