diff --git a/dev/bootstrap-kustomization.yaml b/dev/bootstrap-kustomization.yaml
new file mode 100644
index 0000000..d27560a
--- /dev/null
+++ b/dev/bootstrap-kustomization.yaml
@@ -0,0 +1,31 @@
+# The missing link. Everything else in dev/ — the GitRepository, the two
+# Kustomizations, the three ExternalSecrets — was applied once by hand and then
+# never re-read, because no Kustomization watched this directory. Editing
+# proxy-kustomization.yaml in git changed nothing in the cluster until someone
+# remembered to kubectl apply it, which cost real time more than once (the
+# CONTROL_PLANE_REF_NAME rollout, then LLM_INPUT_COST).
+#
+# This object watches ./dev, so those files are reconciled like any other
+# manifest. It lives in ./dev itself, so it also manages itself — the same
+# self-referential arrangement `flux bootstrap` sets up.
+#
+# Apply it once with kubectl. That is the last manual apply this repo needs.
+#
+# Sharp edge worth knowing: with prune enabled, deleting proxy-kustomization.yaml
+# from git deletes the Kustomization it defines, and that Kustomization's own
+# prune then removes the Kong configuration it manages. That is GitOps behaving
+# correctly, but the blast radius of removing one file is two levels deep.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform-llm-dev-bootstrap
+  namespace: llm
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: platform-llm-dev
+  path: ./dev
+  prune: true
+  # No postBuild here on purpose: the entrypoint manifests carry literal values,
+  # and the substitutions belong to the Kustomizations they define.