diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml
index 0518ac2..e223697 100644
--- a/dev/proxy-kustomization.yaml
+++ b/dev/proxy-kustomization.yaml
@@ -34,14 +34,18 @@ spec:
       # The URI path is the collector's routing key: Fluent Bit tags the
       # record `llm` and turns that into the Loki label domain=llm.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm
+      # Duplicated from k8s-platform's dataplane-template-defaults ConfigMap
+      # rather than pulled via substituteFrom, because that ConfigMap is
+      # deliberately single-instance in flux-system and this Kustomization
+      # cannot live there: its substitution Secret below holds real
+      # credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those
+      # in flux-system is the exact thing the Konnect PAT comment in
+      # gateway-kustomization.yaml refuses to do. Referencing the ConfigMap
+      # from the llm namespace just fails the build outright
+      # (optional: false), which is why this stack never deployed.
+      # Cost of the duplication: changing the cluster trace backend now takes
+      # an edit here too.
+      OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
     substituteFrom:
-      # Listed first so the Secret below still wins on any key it defines.
-      # Brings OTEL_TRACES_ENDPOINT, the cluster-wide trace backend, so this
-      # gateway follows a backend change without a second edit here. The only
-      # key it shares with the inline block above is OIDC_ISSUER, and both
-      # carry the same value.
-      - kind: ConfigMap
-        name: dataplane-template-defaults
-        optional: false
       - kind: Secret
         name: platform-llm-dev-secrets