diff --git a/platform-config/kustomization.yaml b/platform-config/kustomization.yaml
index c7c910f..ec38af9 100644
--- a/platform-config/kustomization.yaml
+++ b/platform-config/kustomization.yaml
@@ -50,7 +50,9 @@ resources:
   - ../platform/keycloak/httproute.yaml
   - ../platform/keycloak/servicemonitor.yaml
   # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
-  - ../platform/oauth2-proxy/httproute.yaml
-  - ../platform/oauth2-proxy/servicemonitor.yaml
+  # TEMP-DEFERRED with the oauth2-proxy HelmRelease (see platform/kustomization.yaml) — re-enable both
+  # together once the operator provisions oauth2-proxy-credentials.
+  # - ../platform/oauth2-proxy/httproute.yaml
+  # - ../platform/oauth2-proxy/servicemonitor.yaml
   # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
   - ../platform/monitoring/grafana-httproute.yaml
diff --git a/platform/kustomization.yaml b/platform/kustomization.yaml
index 71c2630..f692688 100644
--- a/platform/kustomization.yaml
+++ b/platform/kustomization.yaml
@@ -28,7 +28,12 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  - oauth2-proxy       # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off)
+  # TEMP-DEFERRED (PM, pending operator SOPS hand-off): oauth2-proxy's HelmRelease mounts
+  # `existingSecret: oauth2-proxy-credentials`, which is not yet provisioned. Under the unified graph's
+  # `platform` wait:true, a not-ready HR here blocks platform → platform-config → the whole downstream
+  # graph (incl. KubeVirt). Re-enable this line (and the two oauth2-proxy entries in platform-config)
+  # the moment the operator fills platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml + wires it.
+  # - oauth2-proxy     # forward-auth for non-OIDC UIs — needs SOPS `oauth2-proxy-credentials` (hand-off)
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate