diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml
index 1fd8c41..0f7accd 100644
--- a/infra/envoy-gateway/kustomization.yaml
+++ b/infra/envoy-gateway/kustomization.yaml
@@ -1,6 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+# ORPHANED LISTENERS, commented out 2026-08-26. Each of these had a Gateway
+# listener and a TLS cert but ZERO attached routes, because the app is either in
+# deprecated/ (vaultwarden, affine, resume-minio*) or written but never deployed
+# (n8n, wikijs, ollama, openwebui). wiki.jsme.be was one of these on the PUBLIC
+# gateway. Uncomment the pair (certificate + patch) when actually deploying the app.
+
 resources:
   - envoy-gateway-namespace.yaml
   - gateway.yaml
@@ -26,34 +32,35 @@ resources:
   - jellyfin/jellyfin-certificate.yaml
   - longhorn/longhorn-certificate.yaml
   - monitoring/monitoring-certificate.yaml
-  - n8n/n8n-certificate.yaml
+  # - n8n/n8n-certificate.yaml
   - netbootxyz/netbootxyz-certificate.yaml
   - passbolt/passbolt-certificate.yaml
   - proxmox/proxmox-certificate.yaml
   - resume/resume-certificate.yaml
-  - resume/resume-minio-certificate.yaml
-  - resume/resume-minio-webui-certificate.yaml
+  # - resume/resume-minio-certificate.yaml
+  # - resume/resume-minio-webui-certificate.yaml
   - minio-aistor/minio-aistor-api-certificate.yaml
   - minio-aistor/minio-aistor-console-certificate.yaml
   - technitium/technitium-certificate.yaml
   - technitium/technitium-backup-certificate.yaml
   - truenas/truenas-certificate.yaml
   - unifi/unifi-certificate.yaml
-  - wikijs/wikijs-certificate.yaml
+  # - wikijs/wikijs-certificate.yaml
   - zipline/zipline-certificate.yaml
-  - vaultwarden/vaultwarden-certificate.yaml
+  # - vaultwarden/vaultwarden-certificate.yaml
   - databasus/databasus-certificate.yaml
   - excalidraw/excalidraw-certificate.yaml
   - gotify/gotify-certificate.yaml
   - uptime-kuma/uptime-kuma-certificate.yaml
-  - ollama/ollama-certificate.yaml
-  - openwebui/openwebui-certificate.yaml
+  # - ollama/ollama-certificate.yaml
+  # - openwebui/openwebui-certificate.yaml
   - searxng/searxng-certificate.yaml
-  - affine/affine-certificate.yaml
+  # - affine/affine-certificate.yaml
   - pelican/pelican-certificate.yaml
   - pelican/pelican-wings-mc-certificate.yaml
   - pelican/pelican-wings-ark-certificate.yaml
   - outline/outline-certificate.yaml
+  - netbox/netbox-certificate.yaml
 
 patches:
   # Internal gateway patches
@@ -93,30 +100,30 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: longhorn/longhorn-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: n8n/n8n-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: n8n/n8n-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
       kind: Gateway
       name: gateway-internal
     path: netbootxyz/netbootxyz-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: resume/resume-minio-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: resume/resume-minio-webui-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: resume/resume-minio-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: resume/resume-minio-webui-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
@@ -183,12 +190,12 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: resume/resume-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: wikijs/wikijs-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: wikijs/wikijs-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
@@ -207,12 +214,12 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: minio-aistor/minio-aistor-console-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: vaultwarden/vaultwarden-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: vaultwarden/vaultwarden-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
@@ -237,30 +244,30 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: uptime-kuma/uptime-kuma-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: ollama/ollama-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: openwebui/openwebui-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: ollama/ollama-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: openwebui/openwebui-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
       kind: Gateway
       name: gateway-internal
     path: searxng/searxng-gateway-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-internal
-    path: affine/affine-gateway-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-internal
+  # path: affine/affine-gateway-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1
@@ -285,6 +292,12 @@ patches:
       kind: Gateway
       name: gateway-internal
     path: outline/outline-gateway-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-internal
+    path: netbox/netbox-gateway-patch.yaml
 
   # Public gateway patches
   - target:
@@ -335,12 +348,12 @@ patches:
       kind: Gateway
       name: gateway-public
     path: resume/resume-gateway-public-patch.yaml
-  - target:
-      group: gateway.networking.k8s.io
-      version: v1
-      kind: Gateway
-      name: gateway-public
-    path: wikijs/wikijs-gateway-public-patch.yaml
+  # - target:
+  # group: gateway.networking.k8s.io
+  # version: v1
+  # kind: Gateway
+  # name: gateway-public
+  # path: wikijs/wikijs-gateway-public-patch.yaml
   - target:
       group: gateway.networking.k8s.io
       version: v1