diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml
index 18a37d0..c7ae857 100644
--- a/clusters/base/cluster-vars.yaml
+++ b/clusters/base/cluster-vars.yaml
@@ -43,11 +43,9 @@ data:
                                              # which lacks PF; NOT a US region, which also lack PF)
   CLUSTER_POD_CIDR: "10.0.0.0/8"             # Cilium cluster-pool pod CIDR (pods get 10.x); Gluetun
                                              # FIREWALL_OUTBOUND_SUBNETS = allow these to egress via the tunnel
-  PIA_OPENVPN_PORT: "53"                     # PIA OpenVPN endpoint UDP port. PIA's default is 1197, but
-                                             # this home network NATs its OWN OpenVPN server on WAN:1197, so
-                                             # outbound PIA-on-1197 replies never return (tcpdump-confirmed).
-                                             # 53 is proven to traverse this network. Valid PIA ports:
-                                             # 53, 1194, 1197, 1198, 8080, 9201. Other envs may override to 1197.
+  # NOTE: PIA OpenVPN port is HARDCODED "53" in gluetun-gateway.yaml, not a cluster-var — Flux/kustomize
+  # strips quotes around a bare "${VAR}" so a numeric value coerces to int, which k8s rejects for an env
+  # value (same gotcha as the Longhorn numberOfReplicas fix). See DECISIONS-LOG.
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)
diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml
index e7a0ed8..c6a4d25 100644
--- a/platform/kustomization.yaml
+++ b/platform/kustomization.yaml
@@ -17,7 +17,7 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
-  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port ${PIA_OPENVPN_PORT}=53, ADR-0013 amendment).
+  # ---- Phase 3 — Egress / VPN (PIA OpenVPN-UDP on port 53, ADR-0013 amendment).
   #      NOT PIA's default 1197 — this home network NATs its own OpenVPN server on WAN:1197, which
   #      collided with the outbound PIA-on-1197 flow (tcpdump-confirmed; DECISIONS-LOG). ----
   - vpn-egress         # shared Gluetun PIA/OpenVPN-UDP egress gateway + kill-switch (ADR-0013)
diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 545326d..b5202ae 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -41,8 +41,11 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: OPENVPN_ENDPOINT_PORT
-              value: "${PIA_OPENVPN_PORT}"   # NOT 1197 — the home network NATs its own OpenVPN server there,
-                                             # so PIA-on-1197 replies never return (see cluster-vars + DECISIONS-LOG)
+              value: "53"                    # NOT 1197 — the home network NATs its own OpenVPN server there,
+                                             # so PIA-on-1197 replies never return (tcpdump-confirmed; DECISIONS-LOG).
+                                             # Hardcoded (not a ${var}): Flux/kustomize strips quotes on "${VAR}"
+                                             # → int coercion, which k8s rejects for env value (Longhorn-fix gotcha).
+                                             # Valid PIA ports: 53, 1194, 1197, 1198, 8080, 9201.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: