diff --git a/README.md b/README.md
index b328b3d..cedd05b 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,37 @@
 # dataplane-sales
 
 Layer 2 (Gateway infrastructure) for the **sales** bounded context
-(domain team: sales). `DataPlane`, `KonnectExtension`, certs (cert-manager),
-secrets (External Secrets Operator) — one Control Plane per environment,
-referenced by ID (created by `../konnect-platform`, never recreated here).
+(domain team: sales) — one Control Plane per environment, referenced by
+ID (created manually in Konnect for now, never recreated here:
+`84a3dd19-7daf-47e6-84ea-9ad5966b91a6` for `dev`).
 
-Content is generated and PR'd automatically when the matching Control
-Plane is created via the self-service flow in `../konnect-platform` —
-never hand-edited directly.
+Same `gateway-kustomization.yaml` / `externalsecret.yaml` /
+`policies-kustomization.yaml` three-file pattern as `dataplane-catalog`/
+`dataplane-customers`/`dataplane-payments` — see `dataplane-catalog/README.md`
+for the full explanation of each file's role, identical here, not
+repeated. Actual resource template lives in
+`../k8s-platform/dataplane-template/` and
+`../k8s-platform/dataplane-globalpolicy-template/`, this repo only holds
+what's specific to `dev/api-gateway/`.
+
+**IdP**: `https://keycloak.sttlab.local/realms/classic-models` (local
+in-cluster Keycloak), platform-wide default — see `../STATUS.md` sections
+15/16. `JWT_AUDIENCE_WHITELIST` set to `["sales-api", "mcp-sales"]` from
+the start (both the REST and MCP layers were built in the same pass as
+this Layer 2 deploy — see `../STATUS.md` section 22).
+
+**Only `dev/` is real.** `staging/api-gateway/` and `prod/api-gateway/`
+still hold the original TODO placeholder files, not converted, not
+deployed, no Control Plane created for them yet.
+
+**Layer 3 is real here, unlike some other domains at their Layer-2-only
+stage**: `../sales-api` (REST + MCP) was built and deployed the same
+session as this Layer 2 repo — `Gateway sales-dev`: `Programmed: True`,
+DNS entry added to `coredns-custom` (`sales-dev.sttlab.local` →
+the `dataplane-ingress-sales-dev-*` Service `ClusterIP`, same manual
+per-domain step documented in `../STATUS.md` section 17), all REST/MCP
+routes smoke-tested (`401`, not `404`/`502`).
+
+Self-service pipeline (`../konnect-platform` generating this content
+automatically) does not exist yet — still a stub per `../STATUS.md`.
+Everything here is hand-maintained.
diff --git a/dev/api-gateway/dataplane.yaml b/dev/api-gateway/dataplane.yaml
deleted file mode 100644
index b9b11dd..0000000
--- a/dev/api-gateway/dataplane.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-# TODO: DataPlane CRD for sales/dev/api-gateway
-apiVersion: gateway-operator.konghq.com/v1beta1
-kind: DataPlane
-metadata:
-  name: sales-dev
diff --git a/dev/api-gateway/externalsecret.yaml b/dev/api-gateway/externalsecret.yaml
new file mode 100644
index 0000000..32a8f91
--- /dev/null
+++ b/dev/api-gateway/externalsecret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sales-dev-konnect-auth
+  namespace: sales
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: sales-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/sales/dev/konnect-pat
+        property: token
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
new file mode 100644
index 0000000..db124ad
--- /dev/null
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sales-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: sales-dev
+      NAMESPACE: sales
+      CONTROL_PLANE_ID: "84a3dd19-7daf-47e6-84ea-9ad5966b91a6"
+      HOSTNAME: sales-dev.sttlab.local
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults
diff --git a/dev/api-gateway/konnectextension.yaml b/dev/api-gateway/konnectextension.yaml
deleted file mode 100644
index b144df6..0000000
--- a/dev/api-gateway/konnectextension.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-# TODO: KonnectExtension referencing the Control Plane created by
-# konnect-platform/domains/sales/dev/ (by ID, not created here)
-apiVersion: konnect.konghq.com/v1alpha1
-kind: KonnectExtension
-metadata:
-  name: sales-dev
diff --git a/dev/api-gateway/kustomization.yaml b/dev/api-gateway/kustomization.yaml
deleted file mode 100644
index 44ec993..0000000
--- a/dev/api-gateway/kustomization.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - dataplane.yaml
-  - konnectextension.yaml
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
new file mode 100644
index 0000000..43dc884
--- /dev/null
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sales-dev-api-gateway-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-globalpolicy-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: sales-dev
+      NAMESPACE: sales
+      CONTROL_PLANE_REF_NAME: sales-dev-pjdc7
+      JWT_AUDIENCE_WHITELIST: '["sales-api", "mcp-sales"]'
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults