diff --git a/dev/ai-gateway-kustomization.yaml b/dev/ai-gateway-kustomization.yaml
index 980294b..68ca314 100644
--- a/dev/ai-gateway-kustomization.yaml
+++ b/dev/ai-gateway-kustomization.yaml
@@ -2,12 +2,16 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: llm-dev-ai-gateway
-  namespace: flux-system
+  namespace: llm
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: k8s-platform
+    # k8s-platform lives in flux-system: the templates are the platform's,
+    # this Kustomization is the team's. sourceRef resolves in the
+    # Kustomization's own namespace unless told otherwise.
+    namespace: flux-system
   path: ./dataplane-template
   prune: true
   postBuild:
diff --git a/dev/externalsecret-control-plane.yaml b/dev/externalsecret-control-plane.yaml
index a6370a9..2ae2359 100644
--- a/dev/externalsecret-control-plane.yaml
+++ b/dev/externalsecret-control-plane.yaml
@@ -13,7 +13,7 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: llm-dev-control-plane
-  namespace: flux-system
+  namespace: llm
 spec:
   refreshInterval: 1h
   secretStoreRef:
diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml
index 33a2770..550f193 100644
--- a/dev/proxy-kustomization.yaml
+++ b/dev/proxy-kustomization.yaml
@@ -41,18 +41,13 @@ spec:
       # The URI path is the collector's routing key: Fluent Bit tags the
       # record `llm` and turns that into the Loki label domain=llm.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm
-      # Duplicated from k8s-platform's dataplane-template-defaults ConfigMap
-      # rather than pulled via substituteFrom, because that ConfigMap is
-      # deliberately single-instance in flux-system and this Kustomization
-      # cannot live there: its substitution Secret below holds real
-      # credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those
-      # in flux-system is the exact thing the Konnect PAT comment in
-      # gateway-kustomization.yaml refuses to do. Referencing the ConfigMap
-      # from the llm namespace just fails the build outright
-      # (optional: false), which is why this stack never deployed.
-      # Cost of the duplication: changing the cluster trace backend now takes
-      # an edit here too.
-      OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
     substituteFrom:
+      # Readable again now that k8s-platform places this ConfigMap in every
+      # domain namespace. It used to be flux-system only, which is why this
+      # Kustomization — which must stay here, holding real credentials — had to
+      # inline OTEL_TRACES_ENDPOINT instead. Listed first so the Secret still
+      # wins on any key it defines.
+      - kind: ConfigMap
+        name: dataplane-template-defaults
       - kind: Secret
         name: platform-llm-dev-secrets