diff --git a/platform/vpn-egress/kustomization.yaml b/platform/vpn-egress/kustomization.yaml
index c7a590c..e6b547f 100644
--- a/platform/vpn-egress/kustomization.yaml
+++ b/platform/vpn-egress/kustomization.yaml
@@ -6,8 +6,6 @@ resources:
   # gluetun-gateway.yaml RETIRED 2026-08-24 (ADR-0015): the node-level host tunnel is validated +
   # conformance-green (egress-class + vpn-killswitch pass live); a Gluetun *pod* can't be a Cilium
   # egress-gateway target anyway. Steering now flows through the node tun0 via egress-steering.yaml.
-  # NOTE: pia-credentials/pia-custom-ovpn secrets below are now UNUSED (creds are host-side in the
-  # Ansible vault per docs/07) — retained temporarily, pending a follow-up cleanup change.
-  - pia-credentials.sops.yaml
-  - pia-custom-ovpn.sops.yaml   # (was gluetun's PIA .ovpn; superseded host-side — see note above)
+  # pia-credentials.sops.yaml / pia-custom-ovpn.sops.yaml RETIRED 2026-08-24 (ADR-0015): unused after the
+  # gluetun retirement — VPN creds are host-side in the Ansible vault (docs/07), not cluster SOPS Secrets.
   - egress-steering.yaml        # ADR-0015: steer egress-class=vpn pods to the node tun0 (validated 2026-08-24)
diff --git a/platform/vpn-egress/pia-credentials.sops.yaml b/platform/vpn-egress/pia-credentials.sops.yaml
deleted file mode 100644
index f717f1c..0000000
--- a/platform/vpn-egress/pia-credentials.sops.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-# =============================================================================
-# UNUSED after Gluetun retirement (ADR-0015). This Secret was consumed by the
-# in-cluster Gluetun gateway, which no longer exists: VPN egress is now a
-# node-level host OpenVPN tunnel steered by Cilium Egress Gateway, and PIA
-# credentials live HOST-SIDE in the Ansible vault (see spec docs/07), not here.
-#
-# RETAINED temporarily, pending a separate cleanup change that will remove this
-# file and drop it from platform/vpn-egress/kustomization.yaml. Do NOT wire it
-# into any workload. The encrypted payload below is left intact.
-# =============================================================================
-apiVersion: v1
-kind: Secret
-metadata:
-    name: pia-credentials
-    namespace: vpn-egress
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:+ZJsr7WE3qk=,iv:2rZU5ZkPiQSnlcbh7LZepfzbJW1SKPufN3mZEp4BD40=,tag:WDA0oZTDYFyITWYKdZZ/qw==,type:str]
-    password: ENC[AES256_GCM,data:N9E7PGAsidsamIKKvJlr,iv:al3yznXTwmnBP6fDkginAcK83NY+11F78292YjyYu7A=,tag:ixU/bqtEXN8lgF6BkJSWOA==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwcTF5NUhidG5nV0RUNldT
-            L2ZSenVqUXJzdW5ZRXZXdVVrOVVGVFI2SzFzCkZUbnlKbUhSMXk1S0hwZVdBcHFF
-            VFRteHNnOUs2K1dweVdUZkV6bGFZNHcKLS0tIDJEUUczS1N5b2FoTHZxOTRVSDNn
-            UmxJRzdueFY3eDU0M09nSzhBcU9WZU0KcQYxIPMvcHF4btl34PG+rVZcBCjGrxGG
-            nsC0qhiwLcAVRAyQ69SacAUQ9Huv7ZIYlbQZ4FvwJmAjvGdfWRgbpA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-22T03:50:32Z"
-    mac: ENC[AES256_GCM,data:wg1/iQ4YCzDhewkdYS1Qa0RjdWDdNDl8JTOhOe258AW6oSM9b94bLF3RXenvoGOH098/BKsNmQB/q0fDcCM4/35EBh1aQJ0XAdPG458ZHrQ0GtfEHqlWpx8FQdFFItCN5Ja2zJ0fAnEhU+cq63sjdReslm5vNOLMbkrJ2u+lHpc=,iv:aC32phovo1n93PE+ijgHwnRyaDlm42z4rFQD/kTSQFU=,tag:thKx1wl9jQo5V5bh8XixAQ==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4
diff --git a/platform/vpn-egress/pia-custom-ovpn.sops.yaml b/platform/vpn-egress/pia-custom-ovpn.sops.yaml
deleted file mode 100644
index 218bf5a..0000000
--- a/platform/vpn-egress/pia-custom-ovpn.sops.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-# =============================================================================
-# UNUSED after Gluetun retirement (ADR-0015). This Secret held the PIA .ovpn
-# for the in-cluster Gluetun gateway, which no longer exists: VPN egress is now
-# a node-level host OpenVPN tunnel steered by Cilium Egress Gateway, and the
-# .ovpn now lives HOST-SIDE in the Ansible vault (see spec docs/07), not here.
-#
-# RETAINED temporarily, pending a separate cleanup change that will remove this
-# file and drop it from platform/vpn-egress/kustomization.yaml. Do NOT wire it
-# into any workload. The encrypted payload below is left intact.
-# =============================================================================
-apiVersion: v1
-data:
-    sweden-aes-128-cbc-udp-ip.ovpn: ENC[AES256_GCM,data:Z8WUkkAj1n+o0V06FrRk9pSA1d3FGAXgrOevml08nyiWQJcwmHO0wjELWQA8vbGLuv70HYR15cB1irkuPAIqdUFmtjGiuLbpnRo8wvuaAMvP+t2vAz3uzOKMKKAuBgAvlrPacMlWWgiOGhHy8LrkGlomhgODVsUqW76NRIYy/27t8J0JvHNKL+stZ0QliS2OQuegu+WHVGjQ0poAEnCWMq8qvpolMeDYkB3F+j9LMbuxTpMbIYUBui7u924wZMqnzxNygZy/a4v5GgY/oWxd6NS++eZVcbAgIO/+w/KrgLcPnqBRAuCmXKedjVBPcUEDcVV9Nlwhkdkw80A8Mv9uHu4TuDji6Yp1TNcZOsi3FFYWzTVra1GmP3J23eUhfd/ouGSpCm//Y0Zmrf85oEpoeHRw/d3oc+A9txW498HxloAMBHJK7twRIWe2W88Vrpn+hlpoyT9YEVFTKlJlJrHb6UM6Vvg6VerqyPXE3TTWk1OL9XUXtMWtMkyfmjYLcnn3w0j2WTAoChYhfxV4iRiG0UyOnlGNPIXNFSQvOrXNLU/sbJOEkxle3L6y2DA5/3i6ceSitAX0NquGdL72u0rDu+86OG4HW+o41h7o8TRk7HWOhhug9x7nScFsVGrf3WPkIDs/OjIgNFzuXiUMIv796RWCT/cVOk49Peac3mQgAC9m8przyagwplGEVhbN1tkDY+5F4Mh9qrafUNoxSDl9xLekkje4x7n9aClvRv8522bMfRyOkWwtDW5WMdycgdlEmqwHwT7CHZ0CDZW+3+AeoC2U0NcD3UWb1me0nKHXUKHjdD17P7QThes+Iupg51w1FjiTRXW6nOt6MuEUXsEtTzxGs0Dyvv94p3KCFCXJwvgU04/svUmBTqCFaZc4gNyuMcpcuhmmPrVyovPxzZHK4V7yrwk0qEJUZgRYCLAf63IFFRSs1j/jZW1O2uK/KIlJppv0lUfIAlex/jKJuIXbR66uC919H6scYs/ZggFRKL3ZsFX/WKs9spDu9seqqHSEjeGoHniqusv26q3nuoG295OQNsYk7Z0zVpkaQHOQ4pzuiCAkBYHmhLu5upD97j4wbVySr66jmPlDqqanze27Dij9qSVYH6CdfDKLo0sj/d89N0EGEU/kD5Moh5B+c8f0/7Ba2GyMvio+3J0UAPTchXAaH5aHqi8KtQMnvs0Qb1bzC3cNWHUJGAxtaRYQekFyOnRJtaTKHb3I5ySYJH4wJrZlTpmYZHavadAAff+qYFC1CYiu2y4yuGu60bgYq+5b+q+cvj9a06H2Ep1P4dwD5Vt69hCi2ESXW/6YdTPSB35BYgHNKtl3SmmKhxiwTwCQ7i7Wr3msGNzjE4TBnD7acnrpV71rvyhyaGU+m73x0gwAk0jBrN5P+0jOxk6g58XU6UeEnXMXevRDaRtV1efE3puTmijsrJ91TrJawK8mvNDJdrvapQlIikuzDAW4+vffQEdFNrc/ebZVsTWKOW0GfHILnIpTqT5W3o0vJviawaJLrveQ1YTBbc4jjIXrwvB1rkiZ2BceBPMSZ7OOkZ8J93Xc+SkcE5B81aX1sovSfaTS2ACUdJ3P+m03YJq3d0qe4AZeazI8i48KO5RwC53BbRZaVxRDA56/C/7/9H8UkGhuaMn6EFPktfAjBuplQp2qhYfkT8KP64NTKqCp5y+evZbe7MJ09pGgmTMU51X/pTSsBKKNL/c/PM8vSSXpPc59judSswIdhm/qd9I5co2FaM4QkzEKw6DSLEInotmKE2xRh7Mpz7OlVHm2fwvPusnPe7P0EQpyB76SP36Lu7EJq0U9LCHIgoypjkZM4BV2P66iWqacQTcEjR1NwSduzsGXzAf386wNf/meIJUgXzxUpDWZiowMqluN+JMqYAVDK6/ioxfyNYiN82vZaLeNPbPZbk6+U5nKZea9Lqxq7be7c0eUCPfqZbPCAleC4+XSeA3imPlOw/Kiw1zrZ8nfjpwI1k0pZoQsJSFqnlQcmALDgPiUX0UECFAa8dtFxoQoEw0F/fpp2Gzr63Gm586r1GyTivA6gRDPtXYvOFfz3/WHgeq7Wp4sp/rF+PlOBlGyVHfMIXEa9izFAJjMab/ttEf0RiUf6wS2z2KWXxZfoCZRnVsRdAg1RKtOTYG328Ax1FWZrzWFmJJI6XHq0MY/56aOciBf9BIQpDKYxvMEs7/jo2UrlpSYszQZ5qnHjivSnXOn63QhqPLE4B2pQPPr/W+S0hn/C2kB2zpFJ8z2bqf3LObMcT90JNw0XkzByCY20zRczTxSIhSL7ZLORzvIqNRaxZLgT7P/2qNa/3a33Vn3MITRIRXlUjfbA/CjeKVYcaiJou1boaCYLyjBpqweAZ8XCvnqg834KG/t6Wkj0NbL615seBwu439Al84NYu86ipQse3k9Rswgcywh5Bv3WqBnWnEQj/fiW3kyULffm+nAM0anal/1FQ3BYClGUTIwB6l4IC0BfioxK7tHVAi5KdU6qSSwp12Np72xfTdBoRTISFs+U22wEE34pvz5yZvsHlu6K0BWbKxzm4Zog/bH9Dmzqgf+KfoFv0L6UD9XfI6hL3YbGqqrf5ZvzzBm/60+lBVRgTsmuC0gNXKGfRGgq9D2ehWYB5zkd2zTfFFg8n1ot1ZoGiGqC+8jMhXx0BXHMWAopvq7HQnDX0bj7WxCvkpYtP/sJCp5xjNzv+Co8uGpS558dAxJEvwo8DzQwsTQnege+S0KZYsqIpOTpMQnTjeQCKT0Mj1NixIm5BKqoK17fnKOC+kLiZajOlB6cLJPZ+cxCs+pVHX4F2xob0fim/tS0NrBT7W+rTeJqoHqCih+5PtWs8pBccLjEYz3dVxlG9BUL1knRh4g7z+t+ENh89f8CCoeWncEGnMLFay1N3o1Lonkzo25NB8jQdIo95QSDWeoZvCufSIHQYB+uYojSa4qMLtnmn4jDqSy7HLAMWfX4JIa5Miz/35mNIsTdZdTMj4D4R2FQVgmWmEH8jzBEB4/RPqoDJAaUm56LJsaVqG1yTgeGokekji4YxEEw3qfyd0grAQLB9+xZTX08pANdOqx88ITkJ3Qtaam0Ing5mJBiTTgxWG7EHcuWQI2q7MQ2S+Yq7eLNeO96FlSq6AJ4joAxyuE5C6cEHhl+p7D/KdyFNdxcxI1mB+eBch6w5pVstgmdeOLEF18dofAkPmFtCrqWGsXvmwcZkldfH3xAo1bQ3d0Z7nT4SjJkv1dIeiKEIxfR+T/La+Z3jWbhNxvzlETBlbu3XNucFGyOwB/b7OsZu1EfbDj/6Gpktcho5xOeb3K2CiW+BkZw65d/ZtotGgzF2CS/qW/EqrWEkLwnUtznUrz9hnxYk1B1eAx3vaVLdShskBo71fQuA03afBnZrFsDFzEy8WzExcecrW0KqBp8GAzZqAS+c7assPYgVfvhJt5INYldvi6Xl0tmocYRMV0beZoH0kuvqVuDJ1HMWab4mMnNBkV7sW9//yci8ez4kyPdJhw9nPqGZTPqamWiblnYn70GSH0nltkS1khP6jRhH8/SLdjtbOF6KOGPGU4Rlepn3I0WNpDl3BkC6KtMofH6uoIioIlXZqRvSxboExA6zeKimZgk1ZccvZq/UP75QoUgBaDCbI8SAcRopiBZtbKZmm4Fgfy+AxiQ41Le/9GdsqBk26aDMJlKyVXBIG6UbQ6B8oFSXDn3yuEKrx/FIOg3nREx8aJa80Tz2dZY/LCFey35+xzN2A3b6ToEgrQAeqtDNPzyz/9DiKQu7N6xD6EUWzcOJyHDGKYVCXOlb8y30cM7ETZhQmq3JkZSX+DIAHnVM0c7Gp6ltiXs7bralwmG2+062e77NxqDj75AVXtvVkXUDjhHIUE32WWYzc4wJfVqbYG9nwmzUd0Oe+UZqX7bFsHT0ye3QiEs7G8/vSibL5sdEhVw9xSKfCX/N6Cepd8NVy5rnMKo4moAZmnTD1lfKSt4rbX+TLIk2fRCZqftt9knDE/01e3AEGR6ry8nK+tV9aFkSMTy/3fnvQ=,iv:F6dC6trQxJzYxWScQWgeH3WcD/o3paf3HE4Joa+2Tfg=,tag:ZDUfSj+pu+iZSFYMOHmvjQ==,type:str]
-kind: Secret
-metadata:
-    creationTimestamp: null
-    name: pia-custom-ovpn
-    namespace: vpn-egress
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzSm0waC8ySExpNkJIVXh3
-            M0ROTjNOQjVqOWVaZS9mWWszbC8veFhTM0c0ClV1TnFoY0tmeGNYVWJ2azhFaDZD
-            U21CTUpWTk5wM0V2TThMbGN0TzBzZHcKLS0tIEpjVEVUUFZLSjdaV0FScDVWblRa
-            cGkrVzlVRmxhNUJSbk16Q3cyS3huK0kKBGJKufyMS19pUqyY1BAQ9CcEKY+xWUVs
-            uS/w2mHkEqoH2OWhHDp1EYUp2wtBMbtELSCHHHAZ3whTZ2jgv1KC9g==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-23T06:00:12Z"
-    mac: ENC[AES256_GCM,data:5CNPetwpAqnZqgHL2A8zNHEimswPdNVHM8Nz5uv0IHlFcM403V2HBujqlsMK9bT8SNblV8qdLYeE/79nVJmioindXwRKcmy8MO71pDqE8PC2WNiuqUUzdxAjz9bUe28suOKGNyNXoaKjLfeW9BgrESrg59nt7l/PCieR8hD59ng=,iv:w80Gf4moYU7El9ptmmnGHJLGCPJ0jYccqMLMyzDwnkQ=,tag:1LHos9T6on7Yg61fpusg9w==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.9.4