diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml
index 9a8dfa7..1fd8c41 100644
--- a/infra/envoy-gateway/kustomization.yaml
+++ b/infra/envoy-gateway/kustomization.yaml
@@ -6,10 +6,9 @@ resources:
   - gateway.yaml
   - gateway-public.yaml
 
-  # CrowdSec (public gateway hardening) — HELD pending enforcement-scope decision
-  # (EG v1.3.2 SecurityPolicy does not support sectionName; see it-tools-securitypolicy.yaml)
-  # - crowdsec/envoyproxy-public.yaml
-  # - crowdsec/it-tools-securitypolicy.yaml
+  # CrowdSec ext_authz on the whole public gateway (sectionName scoping is
+  # unsupported on EG v1.3.2; envoyproxy-public.yaml is not needed, see its header)
+  - crowdsec/gateway-public-securitypolicy.yaml
 
   # Policies
   - pelican/pelican-wings-clienttrafficpolicy.yaml