diff --git a/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml b/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml
index fc34dbd..e3181e8 100644
--- a/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml
+++ b/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml
@@ -4,15 +4,17 @@
 # ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml).
 #
 # controlPlaneRef.konnectNamespacedRef.name is ${CONTROL_PLANE_REF_NAME},
-# NOT ${NAME} — the KonnectGatewayControlPlane object created by
-# GatewayConfiguration's `mirror` is auto-named by the operator with a
-# random suffix (e.g. catalog-dev-bkphl, not catalog-dev), so this value
-# can't be derived from other vars. Currently looked up manually after the
-# Gateway/GatewayConfiguration first reconcile and filled in per domain's
-# kustomization.yaml — a two-phase step, same as the real reference
-# implementation's kong-rc6s4. The self-service automation pipeline
-# (terraform-konnect-control-plane / konnect-platform, still stubs) should
-# populate this automatically once it exists — see STATUS.md.
+# NOT ${NAME}. The KonnectGatewayControlPlane the operator creates from
+# GatewayConfiguration's `mirror` is auto-named with a random suffix
+# (catalog-dev-bkphl, not catalog-dev), so this value used to be looked up by
+# hand after the first reconcile and pasted in per domain — and it went stale
+# without warning every time the Gateway was recreated.
+#
+# It now names the mirror CR declared in
+# k8s-platform/dataplane-template/controlplane-mirror.yaml, whose name IS
+# derived from ${NAME} (${NAME}-cp) and therefore stable. The operator's own
+# auto-named mirror still exists alongside it; both point at the same control
+# plane id and neither owns its lifecycle.
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongPluginBinding
 metadata:
diff --git a/dataplane-template/controlplane-mirror.yaml b/dataplane-template/controlplane-mirror.yaml
new file mode 100644
index 0000000..412bc01
--- /dev/null
+++ b/dataplane-template/controlplane-mirror.yaml
@@ -0,0 +1,34 @@
+# A stably-named mirror of the domain's Konnect control plane.
+#
+# Why this exists: the Gateway operator also creates a mirrored
+# KonnectGatewayControlPlane of its own, but auto-names it "${NAME}-<random>".
+# Every KongService/KongRoute/KongPluginBinding has to name its control plane
+# through controlPlaneRef.konnectNamespacedRef (this operator version has no
+# konnectID ref type), so that random suffix used to be looked up by hand and
+# pasted into CONTROL_PLANE_REF_NAME in each domain repo. It silently went
+# stale whenever the Gateway was recreated — which is exactly what happened
+# when the Konnect org was replaced: all 11 refs pointed at CRs that no longer
+# existed and every entity sat Programmed=False.
+#
+# This CR is declared with a derived, stable name instead, so the refs never
+# need touching again. It is source: Mirror, which adopts an existing control
+# plane rather than owning its lifecycle — deleting this CR does NOT delete the
+# control plane in Konnect (verified: count unchanged across a delete), so it
+# coexists safely with the operator's own mirror of the same id.
+#
+# CONTROL_PLANE_ID is substituted from the ${NAME}-control-plane Secret that
+# External Secrets materializes from Vault — see the domain's
+# gateway-kustomization.yaml.
+apiVersion: konnect.konghq.com/v1alpha2
+kind: KonnectGatewayControlPlane
+metadata:
+  name: ${NAME}-cp
+  namespace: ${NAMESPACE}
+spec:
+  source: Mirror
+  konnect:
+    authRef:
+      name: ${NAME}
+  mirror:
+    konnect:
+      id: ${CONTROL_PLANE_ID}
diff --git a/dataplane-template/kustomization.yaml b/dataplane-template/kustomization.yaml
index c9f028c..aa036a7 100644
--- a/dataplane-template/kustomization.yaml
+++ b/dataplane-template/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - konnectapiauthconfiguration.yaml
+  - controlplane-mirror.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
   - externalsecret-tls.yaml