diff --git a/clusters/base/cluster-vars.yaml b/clusters/base/cluster-vars.yaml
index 8e48c94..325d99c 100644
--- a/clusters/base/cluster-vars.yaml
+++ b/clusters/base/cluster-vars.yaml
@@ -31,9 +31,9 @@ data:
   # --- admission enforcement (Kyverno, ADR-0011). Base defaults are the STRICT/prod posture;
   #     the dev overlay softens them for bootstrap (Audit / Ignore / 1) so a cold cluster can
   #     come up before policies are proven and admission is HA. ---
-  KYVERNO_VALIDATION_ACTION: "Enforce"      # dev: Audit (observe before enforcing)
-  KYVERNO_WEBHOOK_FAILURE_POLICY: "Fail"    # dev: Ignore (fail-open during bootstrap)
-  KYVERNO_ADMISSION_REPLICAS: "3"           # dev: 1 (no HA needed to iterate)
+  KYVERNO_VALIDATION_ACTION: "Enforce"            # dev: Audit (observe before enforcing)
+  KYVERNO_FORCE_FAILURE_POLICY_IGNORE: "false"    # dev: "true" (chart forceFailurePolicyIgnore = fail-open)
+  KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)
diff --git a/clusters/dev/kustomization.yaml b/clusters/dev/kustomization.yaml
index e873c01..52cfe91 100644
--- a/clusters/dev/kustomization.yaml
+++ b/clusters/dev/kustomization.yaml
@@ -91,8 +91,8 @@ patches:
         path: /data/KYVERNO_VALIDATION_ACTION
         value: "Audit"
       - op: replace
-        path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
-        value: "Ignore"
+        path: /data/KYVERNO_FORCE_FAILURE_POLICY_IGNORE
+        value: "true"
       - op: replace
         path: /data/KYVERNO_ADMISSION_REPLICAS
         value: "1"
diff --git a/platform/kyverno/admission/helmrelease.yaml b/platform/kyverno/admission/helmrelease.yaml
index fa2b0cc..b8c4080 100644
--- a/platform/kyverno/admission/helmrelease.yaml
+++ b/platform/kyverno/admission/helmrelease.yaml
@@ -44,22 +44,23 @@ spec:
       enabled: true
     cleanupController:
       enabled: true
-    # Webhook failure policy — cluster-vars knob (prod Fail / dev Ignore). Fail is fail-CLOSED
-    # (reject rather than silently admit when the webhook is unreachable, coordination-protocol.md
-    # #8); dev uses Ignore (fail-open) so a cold/unhealthy Kyverno cannot brick admission during
-    # bootstrap. The namespaceSelector ALSO excludes system + platform namespaces at the webhook
-    # layer — belt-and-suspenders: policies already scope to app-namespace=true, but this
-    # guarantees kube-system/flux-system/CNI/storage/monitoring admission never routes to Kyverno.
+    # config.webhooks is a MAP in the Kyverno chart (NOT a list — a list breaks the chart's
+    # webhook helper). namespaceSelector excludes system + platform namespaces at the webhook layer
+    # (belt-and-suspenders: the policies already scope to app-namespace=true). forceFailurePolicyIgnore
+    # is the chart's global fail-open switch — a cluster-vars knob: dev enables it (a cold/unhealthy
+    # Kyverno can't brick admission during bootstrap); prod disables it (fail-closed per
+    # coordination-protocol.md #8).
     config:
+      forceFailurePolicyIgnore:
+        enabled: ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}
       webhooks:
-        - failurePolicy: ${KYVERNO_WEBHOOK_FAILURE_POLICY}
-          namespaceSelector:
-            matchExpressions:
-              - key: kubernetes.io/metadata.name
-                operator: NotIn
-                values:
-                  - kube-system
-                  - flux-system
-                  - kyverno
-                  - longhorn-system
-                  - monitoring
+        namespaceSelector:
+          matchExpressions:
+            - key: kubernetes.io/metadata.name
+              operator: NotIn
+              values:
+                - kube-system
+                - flux-system
+                - kyverno
+                - longhorn-system
+                - monitoring