diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml
index 5ff0078..53f171a 100644
--- a/platform/kustomization.yaml
+++ b/platform/kustomization.yaml
@@ -17,6 +17,8 @@ resources:
   - cert-manager       # Let's Encrypt DNS-01 wildcard — needs SOPS `cloudflare-api-token`
   - externaldns        # auto DNS records — needs SOPS `cloudflare-api-token`
   - gateway            # Gateway API listeners (ingress; replaces Traefik)
+  # ---- Phase 3 — Egress / VPN (PIA creds provisioned via SOPS) ----
+  - vpn-egress         # shared Gluetun PIA/WireGuard egress gateway + kill-switch (ADR-0013)
   # ---- Phase 4 — Observability (creds provisioned via SOPS: grafana-admin, alertmanager-smtp) ----
   - monitoring         # kube-prometheus-stack + Loki + Alloy + Alertmanager
   # ---- Later phases: enabled when their phase opens ----