diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml
index 1a1e80e..98f794c 100644
--- a/platform/kustomization.yaml
+++ b/platform/kustomization.yaml
@@ -11,7 +11,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - kyverno            # TODO(PM): enable when the policy engineer's kyverno stub lands (WS-TEST)
+  - kyverno              # PM: enabled — admission enforcer first so policies precede other components
   - cilium
   - longhorn
   - cert-manager
diff --git a/platform/kyverno/kustomization.yaml b/platform/kyverno/kustomization.yaml
new file mode 100644
index 0000000..232de99
--- /dev/null
+++ b/platform/kyverno/kustomization.yaml
@@ -0,0 +1,10 @@
+# PM integration glue (Phase 0): makes platform/kyverno a Flux platform component.
+# Renders the in-cluster ENFORCING bundle authored by WS-TEST (admission/) — Kyverno install
+# + the policies shared verbatim with the CI L0 gate (ADR-0011, docs/07 admission enforcement).
+#
+# The CI-only artifacts (tests/, servicedefinition/ payloads, scripts/run-l0.sh) are intentionally
+# NOT rendered into the cluster — they run in CI (.gitea/ + ci/), not in-cluster.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - admission