diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml
new file mode 100644
index 0000000..58dc312
--- /dev/null
+++ b/dev/api-gateway/externalsecret-control-plane.yaml
@@ -0,0 +1,34 @@
+# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
+# can substitute it instead of carrying a hardcoded UUID.
+#
+# Why a second ExternalSecret rather than extra keys on the existing one:
+# substituteFrom requires the Secret to sit in the same namespace as the Flux
+# Kustomization, which is flux-system — a shared, broadly-readable namespace.
+# The Konnect token must never go there. A Control Plane id is not a secret;
+# it is visible in the Konnect UI URL.
+#
+# Terraform writes this path (see konnect-platform). Moving to a new Konnect
+# org then needs no edit here at all.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: workforce-dev-control-plane
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: workforce-dev-control-plane
+  data:
+    # Key names are the Flux substitution variables verbatim: substituteFrom
+    # exposes each key as ${KEY}.
+    - secretKey: CONTROL_PLANE_ID
+      remoteRef:
+        key: kong-v2/workforce/dev/control-plane
+        property: CONTROL_PLANE_ID
+    - secretKey: CONTROL_PLANE_NAME
+      remoteRef:
+        key: kong-v2/workforce/dev/control-plane
+        property: CONTROL_PLANE_NAME
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
index be215d8..f489f77 100644
--- a/dev/api-gateway/gateway-kustomization.yaml
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -14,8 +14,13 @@ spec:
     substitute:
       NAME: workforce-dev
       NAMESPACE: workforce
-      CONTROL_PLANE_ID: "1dbd741c-0da2-4718-8c72-6f479530b371"
       HOSTNAME: workforce-dev.sttlab.local
     substituteFrom:
       - kind: ConfigMap
         name: dataplane-template-defaults
+      # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
+      # here: a new Konnect org then needs no edit in this repo. Not a secret —
+      # the id is visible in the Konnect UI URL — so flux-system is fine for it,
+      # unlike the token.
+      - kind: Secret
+        name: workforce-dev-control-plane
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index e83b9ce..3d6f2cb 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -14,7 +14,7 @@ spec:
     substitute:
       NAME: workforce-dev
       NAMESPACE: workforce
-      CONTROL_PLANE_REF_NAME: workforce-dev-6cq27
+      CONTROL_PLANE_REF_NAME: workforce-dev-cp
       JWT_AUDIENCE_WHITELIST: '["workforce-api", "mcp-workforce"]'
       OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
     substituteFrom: