diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml
index 5c3e03a..e0fc32f 100644
--- a/platform/kustomization.yaml
+++ b/platform/kustomization.yaml
@@ -29,7 +29,11 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  - oauth2-proxy       # forward-auth for non-OIDC UIs — wildcard cert now LE-prod-trusted + split-horizon DNS live
+  # - oauth2-proxy     # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak,
+  #                    # which lives in platform-config (dependsOn platform) — so it crashloops and
+  #                    # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is
+  #                    # green (Keycloak live). Proper fix = move to a post-platform-config tier
+  #                    # (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
   # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
   # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
   # ---- Later phases: enabled when their phase opens ----