diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml
index c264f59..a68ef2e 100644
--- a/platform-config/kustomization.yaml
+++ b/platform-config/kustomization.yaml
@@ -50,7 +50,11 @@ resources:
   - ../platform/keycloak/httproute.yaml
   - ../platform/keycloak/servicemonitor.yaml
   # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
-  - ../platform/oauth2-proxy/httproute.yaml
-  - ../platform/oauth2-proxy/servicemonitor.yaml
+  # TEMP-DISABLED (parallels platform/kustomization.yaml oauth2-proxy disable): these objects are
+  # in namespace `oauth2-proxy`, created only by the disabled platform/oauth2-proxy component, so
+  # leaving them here fails the platform-config dry-run atomically. Re-enable together with
+  # oauth2-proxy after Keycloak is live (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
+  # - ../platform/oauth2-proxy/httproute.yaml
+  # - ../platform/oauth2-proxy/servicemonitor.yaml
   # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
   - ../platform/monitoring/grafana-httproute.yaml