diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index 7349210..7ff3cf6 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -27,11 +27,8 @@ spec:
       # comment. Automate this lookup once the self-service pipeline exists.
       CONTROL_PLANE_REF_NAME: catalog-dev-bkphl
       # Every audience valid anywhere in the catalog domain — grows as the
-      # domain gains APIs. PLACEHOLDER still: no Keycloak client exists yet
-      # for "catalog-api" (only the classic-models-api client's own audience
-      # mapper exists today) — this openid-connect binding will reject every
-      # real token until that client is created.
-      JWT_AUDIENCE_WHITELIST: '["catalog-api"]' # PLACEHOLDER audience name, Keycloak client not created yet
+      # domain gains APIs.
+      JWT_AUDIENCE_WHITELIST: '["catalog-api", "mcp-catalog"]'
     substituteFrom:
       - kind: ConfigMap
         name: dataplane-template-defaults