diff --git a/dataplane-template/kustomization.yaml b/dataplane-template/kustomization.yaml
index c162b24..bdf5bf8 100644
--- a/dataplane-template/kustomization.yaml
+++ b/dataplane-template/kustomization.yaml
@@ -4,5 +4,4 @@ resources:
   - konnectapiauthconfiguration.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
-  - secret.yaml
   - certificate.yaml
diff --git a/dataplane-template/secret.yaml b/dataplane-template/secret.yaml
deleted file mode 100644
index 9931f61..0000000
--- a/dataplane-template/secret.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-# konghq.com/secret: "true" is required — the Kong Operator's secret
-# watch/cache is scoped to that label; without it, references from
-# KonnectAPIAuthConfiguration.secretRef resolve to "does not exist" even
-# though the Secret is present (see ~/dev/kong/kube/gateway/apigw/secret.yaml).
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ${NAME}-konnect-auth
-  namespace: ${NAMESPACE}
-  labels:
-    konghq.com/credential: konnect
-    konghq.com/secret: "true"
-type: Opaque
-stringData:
-  token: ${KONNECT_PAT_TOKEN}
diff --git a/kong-platform/kustomization.yaml b/kong-platform/kustomization.yaml
index 54ba02e..b4a885a 100644
--- a/kong-platform/kustomization.yaml
+++ b/kong-platform/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 resources:
   - gatewayclass.yaml
   - dataplane-template-defaults.yaml
+  - vault-clustersecretstore.yaml
diff --git a/kong-platform/vault-clustersecretstore.yaml b/kong-platform/vault-clustersecretstore.yaml
new file mode 100644
index 0000000..8409064
--- /dev/null
+++ b/kong-platform/vault-clustersecretstore.yaml
@@ -0,0 +1,32 @@
+# Shared by every kong-v2 domain — one Vault connection, not duplicated per
+# domain. Auth is AppRole (not Kubernetes auth): Vault at vault.sttlab.eu
+# can't reach back into this cluster's API server to validate SA tokens
+# (local cluster's API is https://127.0.0.1:26443, not internet-reachable) —
+# Kubernetes auth was the first choice but isn't viable here.
+#
+# Both roleId and secretId come from vault-approle-kong-v2 (ns
+# external-secrets) — created directly via `vault write` + `kubectl create
+# secret`, never written to a file. Scoped read-only to secrets/kong-v2/*
+# via Vault policy kong-v2-readonly (see Vault directly for policy/role
+# definitions — not tracked in this repo, no Terraform-for-Vault yet).
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: vault-kong-v2
+spec:
+  provider:
+    vault:
+      server: https://vault.sttlab.eu
+      path: secrets
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: vault-approle-kong-v2
+            namespace: external-secrets
+            key: roleId
+          secretRef:
+            name: vault-approle-kong-v2
+            namespace: external-secrets
+            key: secretId