diff --git a/pkg/cli/logs_report_firewall.go b/pkg/cli/logs_report_firewall.go
index fd47d250e48..6a96d728f97 100644
--- a/pkg/cli/logs_report_firewall.go
+++ b/pkg/cli/logs_report_firewall.go
@@ -9,21 +9,22 @@ var firewallReportLog = logger.New("cli:logs_report_firewall")
 
 // AccessLogSummary contains aggregated access log analysis
 type AccessLogSummary struct {
-	TotalRequests  int                        `json:"total_requests" console:"header:Total Requests"`
-	AllowedCount   int                        `json:"allowed_count" console:"header:Allowed"`
-	BlockedCount   int                        `json:"blocked_count" console:"header:Blocked"`
-	AllowedDomains []string                   `json:"allowed_domains" console:"-"`
-	BlockedDomains []string                   `json:"blocked_domains" console:"-"`
-	ByWorkflow     map[string]*DomainAnalysis `json:"by_workflow,omitempty" console:"-"`
+	FirewallSummaryBase
+	ByWorkflow map[string]*DomainAnalysis `json:"by_workflow,omitempty" console:"-"`
+}
+
+// FirewallSummaryBase contains shared aggregated request and domain fields.
+type FirewallSummaryBase struct {
+	TotalRequests   int      `json:"total_requests" console:"header:Total Requests"`
+	AllowedRequests int      `json:"allowed_requests" console:"header:Allowed"`
+	BlockedRequests int      `json:"blocked_requests" console:"header:Blocked"`
+	AllowedDomains  []string `json:"allowed_domains" console:"-"`
+	BlockedDomains  []string `json:"blocked_domains" console:"-"`
 }
 
 // FirewallLogSummary contains aggregated firewall log data
 type FirewallLogSummary struct {
-	TotalRequests    int                           `json:"total_requests" console:"header:Total Requests"`
-	AllowedRequests  int                           `json:"allowed_requests" console:"header:Allowed"`
-	BlockedRequests  int                           `json:"blocked_requests" console:"header:Blocked"`
-	AllowedDomains   []string                      `json:"allowed_domains" console:"-"`
-	BlockedDomains   []string                      `json:"blocked_domains" console:"-"`
+	FirewallSummaryBase
 	RequestsByDomain map[string]DomainRequestStats `json:"requests_by_domain,omitempty" console:"-"`
 	ByWorkflow       map[string]*FirewallAnalysis  `json:"by_workflow,omitempty" console:"-"`
 }
@@ -99,12 +100,14 @@ func buildAccessLogSummary(processedRuns []ProcessedRun) *AccessLogSummary {
 	allowedDomains, blockedDomains := convertDomainsToSortedSlices(agg.allAllowedDomains, agg.allBlockedDomains)
 
 	return &AccessLogSummary{
-		TotalRequests:  agg.totalRequests,
-		AllowedCount:   agg.allowedCount,
-		BlockedCount:   agg.blockedCount,
-		AllowedDomains: allowedDomains,
-		BlockedDomains: blockedDomains,
-		ByWorkflow:     byWorkflow,
+		FirewallSummaryBase: FirewallSummaryBase{
+			TotalRequests:   agg.totalRequests,
+			AllowedRequests: agg.allowedCount,
+			BlockedRequests: agg.blockedCount,
+			AllowedDomains:  allowedDomains,
+			BlockedDomains:  blockedDomains,
+		},
+		ByWorkflow: byWorkflow,
 	}
 }
 
@@ -143,11 +146,13 @@ func buildFirewallLogSummary(processedRuns []ProcessedRun) *FirewallLogSummary {
 	allowedDomains, blockedDomains := convertDomainsToSortedSlices(agg.allAllowedDomains, agg.allBlockedDomains)
 
 	return &FirewallLogSummary{
-		TotalRequests:    agg.totalRequests,
-		AllowedRequests:  agg.allowedCount,
-		BlockedRequests:  agg.blockedCount,
-		AllowedDomains:   allowedDomains,
-		BlockedDomains:   blockedDomains,
+		FirewallSummaryBase: FirewallSummaryBase{
+			TotalRequests:   agg.totalRequests,
+			AllowedRequests: agg.allowedCount,
+			BlockedRequests: agg.blockedCount,
+			AllowedDomains:  allowedDomains,
+			BlockedDomains:  blockedDomains,
+		},
 		RequestsByDomain: allRequestsByDomain,
 		ByWorkflow:       byWorkflow,
 	}
diff --git a/pkg/cli/logs_report_test.go b/pkg/cli/logs_report_test.go
index f9d28daaeed..15967eb801a 100644
--- a/pkg/cli/logs_report_test.go
+++ b/pkg/cli/logs_report_test.go
@@ -3,6 +3,7 @@
 package cli
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
@@ -720,11 +721,11 @@ func TestBuildAccessLogSummaryWithSharedHelper(t *testing.T) {
 	if summary.TotalRequests != 15 {
 		t.Errorf("Expected TotalRequests = 15, got %d", summary.TotalRequests)
 	}
-	if summary.AllowedCount != 13 {
-		t.Errorf("Expected AllowedCount = 13, got %d", summary.AllowedCount)
+	if summary.AllowedRequests != 13 {
+		t.Errorf("Expected AllowedRequests = 13, got %d", summary.AllowedRequests)
 	}
-	if summary.BlockedCount != 2 {
-		t.Errorf("Expected BlockedCount = 2, got %d", summary.BlockedCount)
+	if summary.BlockedRequests != 2 {
+		t.Errorf("Expected BlockedRequests = 2, got %d", summary.BlockedRequests)
 	}
 
 	// Check sorted domains
@@ -748,6 +749,41 @@ func TestBuildAccessLogSummaryWithSharedHelper(t *testing.T) {
 	}
 }
 
+func TestAccessLogSummaryJSONUsesEmbeddedBaseFields(t *testing.T) {
+	summary := AccessLogSummary{
+		FirewallSummaryBase: FirewallSummaryBase{
+			TotalRequests:   3,
+			AllowedRequests: 2,
+			BlockedRequests: 1,
+			AllowedDomains:  []string{"example.com"},
+			BlockedDomains:  []string{"blocked.com"},
+		},
+	}
+
+	data, err := json.Marshal(summary)
+	if err != nil {
+		t.Fatalf("Marshal() error = %v", err)
+	}
+
+	var got map[string]any
+	if err := json.Unmarshal(data, &got); err != nil {
+		t.Fatalf("Unmarshal() error = %v", err)
+	}
+
+	if got["allowed_requests"] != float64(2) {
+		t.Fatalf("expected allowed_requests = 2, got %v", got["allowed_requests"])
+	}
+	if got["blocked_requests"] != float64(1) {
+		t.Fatalf("expected blocked_requests = 1, got %v", got["blocked_requests"])
+	}
+	if _, ok := got["allowed_count"]; ok {
+		t.Fatalf("did not expect legacy allowed_count field in %s", string(data))
+	}
+	if _, ok := got["blocked_count"]; ok {
+		t.Fatalf("did not expect legacy blocked_count field in %s", string(data))
+	}
+}
+
 // TestBuildFirewallLogSummaryWithSharedHelper tests firewall log summary with shared helper
 func TestBuildFirewallLogSummaryWithSharedHelper(t *testing.T) {
 	processedRuns := []ProcessedRun{