diff --git a/dev/ai-gateway-kustomization.yaml b/dev/ai-gateway-kustomization.yaml
index f6b0735..980294b 100644
--- a/dev/ai-gateway-kustomization.yaml
+++ b/dev/ai-gateway-kustomization.yaml
@@ -14,8 +14,13 @@ spec:
     substitute:
       NAME: llm-dev
       NAMESPACE: llm
-      CONTROL_PLANE_ID: "61bd9456-7f3b-4312-bf1e-44e7e7f2dade"
       HOSTNAME: llm-dev.sttlab.local
     substituteFrom:
       - kind: ConfigMap
         name: dataplane-template-defaults
+      # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
+      # here: a new Konnect org then needs no edit in this repo. Not a secret —
+      # the id is visible in the Konnect UI URL — so flux-system is fine for it,
+      # unlike the token.
+      - kind: Secret
+        name: llm-dev-control-plane
diff --git a/dev/externalsecret-control-plane.yaml b/dev/externalsecret-control-plane.yaml
new file mode 100644
index 0000000..a6370a9
--- /dev/null
+++ b/dev/externalsecret-control-plane.yaml
@@ -0,0 +1,34 @@
+# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
+# can substitute it instead of carrying a hardcoded UUID.
+#
+# Why a second ExternalSecret rather than extra keys on the existing one:
+# substituteFrom requires the Secret to sit in the same namespace as the Flux
+# Kustomization, which is flux-system — a shared, broadly-readable namespace.
+# The Konnect token must never go there. A Control Plane id is not a secret;
+# it is visible in the Konnect UI URL.
+#
+# Terraform writes this path (see konnect-platform). Moving to a new Konnect
+# org then needs no edit here at all.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: llm-dev-control-plane
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: llm-dev-control-plane
+  data:
+    # Key names are the Flux substitution variables verbatim: substituteFrom
+    # exposes each key as ${KEY}.
+    - secretKey: CONTROL_PLANE_ID
+      remoteRef:
+        key: kong-v2/llm/dev/control-plane
+        property: CONTROL_PLANE_ID
+    - secretKey: CONTROL_PLANE_NAME
+      remoteRef:
+        key: kong-v2/llm/dev/control-plane
+        property: CONTROL_PLANE_NAME
diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml
index dcf3f51..0518ac2 100644
--- a/dev/proxy-kustomization.yaml
+++ b/dev/proxy-kustomization.yaml
@@ -17,7 +17,7 @@ spec:
     substitute:
       NAME: llm-dev
       NAMESPACE: llm
-      CONTROL_PLANE_REF_NAME: llm-dev-jzvxt
+      CONTROL_PLANE_REF_NAME: llm-dev-cp
       OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
       AGENT_AUDIENCE: '["llm-proxy"]'
       OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions