diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml
new file mode 100644
index 0000000..2f75c27
--- /dev/null
+++ b/dev/api-gateway/externalsecret-control-plane.yaml
@@ -0,0 +1,34 @@
+# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
+# can substitute it instead of carrying a hardcoded UUID.
+#
+# Why a second ExternalSecret rather than extra keys on the existing one:
+# substituteFrom requires the Secret to sit in the same namespace as the Flux
+# Kustomization, which is flux-system — a shared, broadly-readable namespace.
+# The Konnect token must never go there. A Control Plane id is not a secret;
+# it is visible in the Konnect UI URL.
+#
+# Terraform writes this path (see konnect-platform). Moving to a new Konnect
+# org then needs no edit here at all.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: payments-dev-control-plane
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: payments-dev-control-plane
+  data:
+    # Key names are the Flux substitution variables verbatim: substituteFrom
+    # exposes each key as ${KEY}.
+    - secretKey: CONTROL_PLANE_ID
+      remoteRef:
+        key: kong-v2/payments/dev/control-plane
+        property: CONTROL_PLANE_ID
+    - secretKey: CONTROL_PLANE_NAME
+      remoteRef:
+        key: kong-v2/payments/dev/control-plane
+        property: CONTROL_PLANE_NAME
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
index 45ecfdf..c51768a 100644
--- a/dev/api-gateway/gateway-kustomization.yaml
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -23,7 +23,6 @@ spec:
     substitute:
       NAME: payments-dev
       NAMESPACE: payments
-      CONTROL_PLANE_ID: "dc3b2a36-e2ad-4da1-a142-022d0ce6d94e"
       HOSTNAME: payments-dev.sttlab.local
     # Cluster-wide defaults only — the Konnect PAT is NOT handled via
     # substitute/substituteFrom at all: that mechanism requires the source
@@ -35,3 +34,9 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: dataplane-template-defaults
+      # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
+      # here: a new Konnect org then needs no edit in this repo. Not a secret —
+      # the id is visible in the Konnect UI URL — so flux-system is fine for it,
+      # unlike the token.
+      - kind: Secret
+        name: payments-dev-control-plane
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index 2467e58..bce8503 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -19,11 +19,10 @@ spec:
     substitute:
       NAME: payments-dev
       NAMESPACE: payments
-      # Looked up manually after gateway-kustomization.yaml's
-      # Gateway/GatewayConfiguration first reconciled — the operator
-      # auto-names the mirrored KonnectGatewayControlPlane with a random
-      # suffix, not derivable from NAME.
-      CONTROL_PLANE_REF_NAME: payments-dev-bz6vs
+      # Stable by construction: the mirror CR is declared with this derived
+      # name in k8s-platform/dataplane-template/controlplane-mirror.yaml, so
+      # it no longer has to be looked up after each Gateway reconcile.
+      CONTROL_PLANE_REF_NAME: payments-dev-cp
       # Every audience valid anywhere in the payments domain. mcp-payments
       # added 2026-08-23 alongside the payments-mcp Kong layer
       # (payments-api/kong/mcp/).