diff --git a/dev/bootstrap-kustomization.yaml b/dev/bootstrap-kustomization.yaml
new file mode 100644
index 0000000..a5d56aa
--- /dev/null
+++ b/dev/bootstrap-kustomization.yaml
@@ -0,0 +1,33 @@
+# The missing link. Everything else in dev/ — the GitRepository, the
+# Kustomization that deploys ./kong, and the two ExternalSecrets — was applied
+# once by hand and then never re-read, because nothing watched this directory.
+# Editing flux-kustomization.yaml in git changed nothing in the cluster until
+# someone remembered to kubectl apply it. That is what silently swallowed the
+# CONTROL_PLANE_REF_NAME rollout: the value was correct in git for hours while
+# the cluster still held the old one.
+#
+# This object watches ./dev, so those files reconcile like any other manifest.
+# It lives in ./dev itself, so it also manages itself — the arrangement
+# `flux bootstrap` sets up, and which flux-operator does not create.
+#
+# It sits in the catalog namespace, not flux-system: sourceRef resolves in the
+# Kustomization's own namespace, and this is the team's to own.
+#
+# Apply once with kubectl. That is the last manual apply this repo needs.
+#
+# Sharp edge: with prune enabled, deleting flux-kustomization.yaml from git
+# deletes the Kustomization it defines, and that Kustomization's own prune then
+# removes the Kong configuration it manages. Correct GitOps behaviour, but the
+# blast radius of removing one file is two levels deep.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: catalog-api-dev-bootstrap
+  namespace: catalog
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: catalog-api-dev
+  path: ./dev
+  prune: true