diff --git a/dev/flux-kustomization.yaml b/dev/flux-kustomization.yaml
index 682f2f6..495561f 100644
--- a/dev/flux-kustomization.yaml
+++ b/dev/flux-kustomization.yaml
@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: catalog-dev-api
-  namespace: flux-system
+  namespace: catalog
 spec:
   interval: 10m
   sourceRef:
@@ -12,16 +12,12 @@ spec:
   prune: true
   dependsOn:
     - name: catalog-dev-api-gateway
+      namespace: flux-system
   postBuild:
     substitute:
       NAME: catalog-dev
       NAMESPACE: catalog
       CONTROL_PLANE_REF_NAME: catalog-dev-bkphl
       BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
-      # PLACEHOLDER audience name — no Keycloak client for "catalog-api"
-      # exists yet, this will reject every real token until that client is
-      # created.
+      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
       API_AUDIENCE: '["catalog-api"]'
-    substituteFrom:
-      - kind: ConfigMap
-        name: dataplane-template-defaults
diff --git a/dev/kong/kongplugin.yaml b/dev/kong/kongplugin.yaml
index 78c1f60..fbcf99f 100644
--- a/dev/kong/kongplugin.yaml
+++ b/dev/kong/kongplugin.yaml
@@ -1,11 +1,3 @@
-# Per-API audience check — narrows on top of the domain-wide whitelist
-# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
-# scope: GlobalInControlPlane). Defense in depth: both instances run
-# independently on every request (verified Kong behavior, see STATUS.md).
-#
-# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
-# (only classic-models-api's own client/mapper does) — this will reject
-# every real token until that client + its oidc-audience-mapper are created.
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -14,17 +6,8 @@ metadata:
 plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
-  # Whole YAML flow-sequence as one string var, same reason as
-  # JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
-  # does plain text substitution, not list generation.
   audience_required: ${API_AUDIENCE}
   auth_methods:
     - bearer
   display_errors: false
-  # This Control Plane enforces a global tls_certificate_verify option
-  # (Konnect-side, not set by us) that rejects any plugin instance whose TLS
-  # verification is off — openid-connect defaults to ssl_verify: false,
-  # which silently broke the DataPlane's config sync entirely (verified via
-  # DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
-  # the correct fix anyway: verify the issuer's cert when fetching JWKS.
   ssl_verify: true
diff --git a/dev/kong/kustomization.yaml b/dev/kong/kustomization.yaml
index d104ce4..6c0e329 100644
--- a/dev/kong/kustomization.yaml
+++ b/dev/kong/kustomization.yaml
@@ -1,10 +1,3 @@
-# Explicit on purpose, unlike catalog-api's earlier (removed) layout —
-# kong-kustomization.yaml (the Flux CR) now lives in this same directory,
-# and Flux's path-without-a-kustomization.yaml auto-generation scans every
-# yaml file present, indiscriminately. Without this explicit list, it would
-# include kong-kustomization.yaml itself as a managed resource — the
-# Kustomization would end up applying (and, with prune: true, potentially
-# pruning) its own object. Listing resources explicitly avoids that.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
diff --git a/dev/kong/pluginbindings.yaml b/dev/kong/pluginbindings.yaml
index e7b5e36..2b99156 100644
--- a/dev/kong/pluginbindings.yaml
+++ b/dev/kong/pluginbindings.yaml
@@ -1,7 +1,3 @@
-# Bound to the natively-authored KongService (../service.yaml), not to
-# individual routes — all of catalog-api's routes share the same audience,
-# same as tasks-api's pattern. Unlike the earlier HTTPRoute-derived
-# KongService, this name is ours and stable across reconciles.
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongPluginBinding
 metadata:
diff --git a/dev/kong/routes.yaml b/dev/kong/routes.yaml
index 8e40c7f..f17eb89 100644
--- a/dev/kong/routes.yaml
+++ b/dev/kong/routes.yaml
@@ -1,9 +1,3 @@
-# One KongRoute per operation in ../openapi.yaml (14 total — same
-# granularity as ~/dev/kong/kube/apis/tasks-api/routes.yaml: split by
-# operation even when two share a path, so a future per-operation policy
-# doesn't require restructuring). Regex paths use Kong's own `~` syntax
-# directly — no auto-translation layer involved this time (that was
-# specific to the HTTPRoute path we abandoned).
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongRoute
 metadata:
diff --git a/dev/kong/service.yaml b/dev/kong/service.yaml
index 8bedbe1..9d64df3 100644
--- a/dev/kong/service.yaml
+++ b/dev/kong/service.yaml
@@ -1,11 +1,3 @@
-# host is a plain DNS string, not a Kubernetes object reference — unlike
-# HTTPRoute's backendRefs, this needs no ReferenceGrant to cross into the
-# classic-models namespace.
-#
-# metadata.name carries the ${NAME} (env) prefix because this domain's
-# environments share one k8s namespace (see dataplane-catalog's own
-# NAME/NAMESPACE split) — spec.name (Kong/Konnect-side) doesn't need it,
-# each env already has its own isolated Control Plane.
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongService
 metadata:
diff --git a/gitrepository.yaml b/gitrepository.yaml
new file mode 100644
index 0000000..d826fc2
--- /dev/null
+++ b/gitrepository.yaml
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: catalog-api
+  namespace: catalog
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-catalog-api.git
+  secretRef:
+    name: catalog-api-git-auth
+  ref:
+    branch: main