Locking Down a "Public" MongoDB Atlas Cluster Without Breaking Anyone's Workflow

I run a small K3s cluster spread across a handful of VPS nodes, plus a MongoDB Atlas cluster that several backend services talk to. At some point, Atlas's Network Access list had drifted to 0.0.0.0/0