diff --git a/dataplane-globalpolicy-template/global-policies-plugins.yaml b/dataplane-globalpolicy-template/global-policies-plugins.yaml
index 0cb36b0..f6f516e 100644
--- a/dataplane-globalpolicy-template/global-policies-plugins.yaml
+++ b/dataplane-globalpolicy-template/global-policies-plugins.yaml
@@ -1,9 +1,3 @@
-# Global (per-domain-CP) baseline policies — security, API behavior
-# consistency, observability. Bound via global-policies-pluginbindings.yaml
-# with scope: GlobalInControlPlane (applies to all traffic in this domain's
-# Control Plane, no per-route/service target needed — verified mechanism,
-# see ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml's
-# tasks-rate-limiting-global-binding).
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -12,28 +6,10 @@ metadata:
 plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
-  # Whitelist of every audience valid anywhere in this domain, not one
-  # audience — a domain can expose several APIs, each with its own audience.
-  # This global check only proves "this token belongs to *some* API of this
-  # domain, minted by our IdP" — narrowing to the *specific* API's own
-  # audience happens again at that API's own KongService/Route (defense in
-  # depth: two independent openid-connect instances, Kong runs both on every
-  # request, verified — see STATUS.md). JWT_AUDIENCE_WHITELIST is a single
-  # var holding the whole YAML flow-sequence as a string (e.g.
-  # '["catalog-api", "catalog-mcp"]') because postBuild.substitute does
-  # plain text substitution, not list generation — grows as the domain gains
-  # APIs, set in policies-kustomization.yaml, not here.
   audience_required: ${JWT_AUDIENCE_WHITELIST}
   auth_methods:
     - bearer
-  display_errors: false # never leak IdP/token internals in error responses
-  # Every domain's Control Plane enforces a global tls_certificate_verify
-  # option (Konnect-side) that rejects plugin instances with TLS verification
-  # off. openid-connect defaults to ssl_verify: false, which silently broke
-  # DataPlane config sync entirely (verified via pod logs: "ssl_verify cannot
-  # be disabled" — the DataPlane never applied ANY config past this plugin,
-  # not just this domain's, until fixed). Explicit true is also the correct
-  # choice on its own merits: verify the issuer's cert when fetching JWKS.
+  display_errors: false
   ssl_verify: true
 ---
 apiVersion: configuration.konghq.com/v1
@@ -88,12 +64,6 @@ config:
   generator: uuid
   echo_downstream: true
 ---
-# Hides whatever the backend actually returned on 5xx (stack traces, DB
-# errors, etc.) behind a standard body. Only covers responses from a
-# successfully-contacted backend ("service"-origin errors) — Kong's own
-# generated errors (502/503/504 before reaching the backend, timeouts) are
-# NOT covered by this plugin, that's the exit-transformer / Enterprise
-# question still pending.
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -131,3 +101,5 @@ config:
   traces_endpoint: ${OTEL_TRACES_ENDPOINT}
   resource_attributes:
     service.name: ${NAME}
+  sampling_rate: 1
+  http_response_header_for_traceid: X-Trace-Id
diff --git a/dataplane-template/gatewayconfiguration.yaml b/dataplane-template/gatewayconfiguration.yaml
index b247cce..7bd617e 100644
--- a/dataplane-template/gatewayconfiguration.yaml
+++ b/dataplane-template/gatewayconfiguration.yaml
@@ -12,6 +12,29 @@ spec:
           containers:
             - name: proxy
               image: ${GATEWAY_IMAGE}
+              env:
+                - name: KONG_TRACING_INSTRUMENTATIONS
+                  value: "all"
+                - name: KONG_TRACING_SAMPLING_RATE
+                  value: "1.0"
+                - name: KONG_OPENTELEMETRY_TRACING
+                  value: "on"
+                - name: KONG_NGINX_PROXY_PROXY_BUFFER_SIZE
+                  value: "128k"
+                - name: KONG_NGINX_PROXY_PROXY_BUFFERS
+                  value: "8 128k"
+                - name: KONG_NGINX_PROXY_PROXY_BUSY_BUFFERS_SIZE
+                  value: "256k"
+                - name: KONG_NGINX_PROXY_LARGE_CLIENT_HEADER_BUFFERS
+                  value: "4 32k"
+                - name: KONG_NGINX_HTTP_PROXY_BUFFER_SIZE
+                  value: "128k"
+                - name: KONG_NGINX_HTTP_PROXY_BUFFERS
+                  value: "8 128k"
+                - name: KONG_NGINX_HTTP_PROXY_BUSY_BUFFERS_SIZE
+                  value: "256k"
+                - name: KONG_NGINX_HTTP_LARGE_CLIENT_HEADER_BUFFERS
+                  value: "4 32k"
   konnect:
     authRef:
       name: ${NAME}
diff --git a/flux/gitrepository.yaml b/flux/gitrepository.yaml
index c3137b7..e6634a6 100644
--- a/flux/gitrepository.yaml
+++ b/flux/gitrepository.yaml
@@ -1,21 +1,3 @@
-# Bootstrap step, same category as installing the Flux Operator itself
-# (see ../README.md): this file was applied manually once
-# (`kubectl apply -f gitrepository.yaml`), because nothing can apply it
-# automatically before it exists — Flux can't fetch the object that tells it
-# where to fetch from. After that one-time apply, since this file lives
-# inside the k8s-platform repo that the GitRepository itself now points at,
-# a root Kustomization reconciling k8s-platform's own `flux/` directory
-# would keep it (and everything else here) self-managing going forward —
-# not scaffolded yet, out of scope for this file.
-#
-# secretRef -> k8s-platform-git-auth: SSH identity/known_hosts, created
-# directly via `kubectl create secret` (never written to a file), backed by
-# ~/.ssh/id_rsa (fingerprint SHA256:+BneVyWyJgOlDvISQ597e9YTXmd3GPpN9XHcItgQGKk,
-# already an authorized key on this Gitea account).
-#
-# Any other repo's Kustomization (e.g. dataplane-catalog's
-# kustomization.yaml) can reference this SAME GitRepository by name — one
-# GitRepository per source repo, not per consumer.
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: GitRepository
 metadata: