diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index f937459..2467e58 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -24,9 +24,10 @@ spec:
       # auto-names the mirrored KonnectGatewayControlPlane with a random
       # suffix, not derivable from NAME.
       CONTROL_PLANE_REF_NAME: payments-dev-bz6vs
-      # Every audience valid anywhere in the payments domain — grows as the
-      # domain gains APIs (e.g. mcp-payments, if an MCP layer is ever added).
-      JWT_AUDIENCE_WHITELIST: '["payments-api"]'
+      # Every audience valid anywhere in the payments domain. mcp-payments
+      # added 2026-08-23 alongside the payments-mcp Kong layer
+      # (payments-api/kong/mcp/).
+      JWT_AUDIENCE_WHITELIST: '["payments-api", "mcp-payments"]'
       # Local in-cluster Keycloak is the platform-wide IdP now (see
       # ../../../STATUS.md sections 15/16), not dataplane-template-defaults'
       # stale VPS value — confirmed reachable in-cluster before wiring this