diff --git a/dataplane-globalpolicy-template/global-policies-plugins.yaml b/dataplane-globalpolicy-template/global-policies-plugins.yaml
index 8c8253b..0cb36b0 100644
--- a/dataplane-globalpolicy-template/global-policies-plugins.yaml
+++ b/dataplane-globalpolicy-template/global-policies-plugins.yaml
@@ -27,6 +27,14 @@ config:
   auth_methods:
     - bearer
   display_errors: false # never leak IdP/token internals in error responses
+  # Every domain's Control Plane enforces a global tls_certificate_verify
+  # option (Konnect-side) that rejects plugin instances with TLS verification
+  # off. openid-connect defaults to ssl_verify: false, which silently broke
+  # DataPlane config sync entirely (verified via pod logs: "ssl_verify cannot
+  # be disabled" — the DataPlane never applied ANY config past this plugin,
+  # not just this domain's, until fixed). Explicit true is also the correct
+  # choice on its own merits: verify the issuer's cert when fetching JWKS.
+  ssl_verify: true
 ---
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin