diff --git a/dev/api-gateway/bootstrap-kustomization.yaml b/dev/api-gateway/bootstrap-kustomization.yaml
new file mode 100644
index 0000000..0367230
--- /dev/null
+++ b/dev/api-gateway/bootstrap-kustomization.yaml
@@ -0,0 +1,24 @@
+# Watches ./dev/api-gateway so the entrypoints in it — the GitRepository above,
+# the gateway and policies Kustomizations, the ExternalSecrets — reconcile from
+# git instead of waiting on a kubectl apply. Lives in that directory, so it
+# manages itself.
+#
+# In the catalog namespace, not flux-system. The gateway Kustomizations sat in
+# flux-system only because postBuild.substituteFrom reads a ConfigMap from its
+# own namespace and dataplane-template-defaults existed nowhere else. That
+# ConfigMap is now in every domain namespace, so the constraint is gone and the
+# team can own its own gateway.
+#
+# Apply once with kubectl. That is the last manual apply this repo needs.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dataplane-catalog-dev-bootstrap
+  namespace: catalog
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: dataplane-catalog-dev
+  path: ./dev/api-gateway
+  prune: true
diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml
index 1c8482d..a5255a6 100644
--- a/dev/api-gateway/externalsecret-control-plane.yaml
+++ b/dev/api-gateway/externalsecret-control-plane.yaml
@@ -1,3 +1,8 @@
+# Moved out of flux-system with the Kustomization that reads it. It only ever
+# lived there because postBuild.substituteFrom resolves in the Kustomization's
+# own namespace, and that Kustomization had to be in flux-system to reach
+# dataplane-template-defaults. Both now sit in the domain namespace, so the
+# control-plane id no longer transits a shared namespace at all.
 # The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
 # can substitute it instead of carrying a hardcoded UUID.
 #
@@ -13,7 +18,7 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: catalog-dev-control-plane
-  namespace: flux-system
+  namespace: catalog
 spec:
   refreshInterval: 1h
   secretStoreRef:
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
index 314d24a..11efcda 100644
--- a/dev/api-gateway/gateway-kustomization.yaml
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -7,7 +7,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: catalog-dev-api-gateway
-  namespace: flux-system
+  namespace: catalog
 spec:
   interval: 10m
   sourceRef:
@@ -35,8 +35,8 @@ spec:
       - kind: ConfigMap
         name: dataplane-template-defaults
       # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
-      # here: a new Konnect org then needs no edit in this repo. Not a secret —
-      # the id is visible in the Konnect UI URL — so flux-system is fine for it,
-      # unlike the token.
+      # here: a new Konnect org then needs no edit in this repo. Both this
+      # Secret and this Kustomization are in the domain namespace now, so the
+      # id no longer has to pass through flux-system to be substitutable.
       - kind: Secret
         name: catalog-dev-control-plane
diff --git a/dev/api-gateway/gitrepository.yaml b/dev/api-gateway/gitrepository.yaml
new file mode 100644
index 0000000..7f81082
--- /dev/null
+++ b/dev/api-gateway/gitrepository.yaml
@@ -0,0 +1,21 @@
+# This repo, as a source Flux can read. It had none: its Kustomizations point at
+# k8s-platform for the templates, and nothing ever needed to read the repo that
+# declares them — because those declarations were applied by hand.
+#
+# Reuses the domain's existing deploy key rather than minting a new one. Verified
+# that it reads this repository: a throwaway GitRepository with secretRef
+# catalog-api-git-auth reached Ready against this URL. Worth knowing what that
+# implies — the key is not scoped to a single repository, so the isolation its
+# per-repo name suggests does not exist.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: dataplane-catalog-dev
+  namespace: catalog
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-dataplane-catalog.git
+  secretRef:
+    name: catalog-api-git-auth
+  ref:
+    branch: main
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index 1c391d4..9211016 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -7,7 +7,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: catalog-dev-api-gateway-policies
-  namespace: flux-system
+  namespace: catalog
 spec:
   interval: 10m
   sourceRef: