diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml
index 766595f..59036f9 100644
--- a/dev/proxy-kustomization.yaml
+++ b/dev/proxy-kustomization.yaml
@@ -21,7 +21,12 @@ spec:
       NAME: llm-dev
       NAMESPACE: llm
       CONTROL_PLANE_REF_NAME: llm-dev-cp
-      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
+      # The classic-models realm on the lab Keycloak, not the stale VPS realm
+      # inherited from dataplane-template-defaults. Every domain gateway
+      # overrides it the same way; this one was missed, so its openid-connect
+      # plugin validated against the wrong JWKS and answered 401 to every
+      # token — visible only as "invalid signature" in the gateway log.
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
       AGENT_AUDIENCE: '["llm-proxy"]'
       OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions
       # Cost per 1M tokens for the model behind OPENROUTER_UPSTREAM_URL, used by