diff --git a/clusters/dev/kustomization.yaml b/clusters/dev/kustomization.yaml
index 1fe6ca4..10c83cc 100644
--- a/clusters/dev/kustomization.yaml
+++ b/clusters/dev/kustomization.yaml
@@ -65,6 +65,12 @@ patches:
       - op: replace
         path: /data/ACME_CLUSTER_ISSUER
         value: "letsencrypt-prod"
+      # Split-horizon DNS target: the Cilium-L2 VIP of the `shared` Gateway on the Proxmox LAN
+      # (base default 10.73.0.240 was the old libvirt VIP). coredns-custom answers
+      # *.home.keithjackson.dev with this so in-cluster OIDC clients reach Keycloak via the Gateway.
+      - op: replace
+        path: /data/GATEWAY_VIP
+        value: "192.168.1.53"
       # dev mirrors prod's 3-node topology, so the replicated tier keeps 3 replicas.
       - op: replace
         path: /data/LONGHORN_DEFAULT_REPLICA_COUNT