diff --git a/k8s/apps/api/kong-values.yaml b/k8s/apps/api/kong-values.yaml
index ac69f34..f737bf5 100644
--- a/k8s/apps/api/kong-values.yaml
+++ b/k8s/apps/api/kong-values.yaml
@@ -57,6 +57,17 @@ env:
   # nginx Ingress in ingress.yaml; both hops have to be unbuffered or the
   # buffered one dominates.
   nginx_proxy_proxy_buffering: "off"
+  # Any plugin that rewrites the request body — request-transformer on the
+  # llm-chat-* routes — reads it through `kong.request.get_body()`, and that
+  # returns nothing once nginx has spilled the body past
+  # client_body_buffer_size into a temp file. The plugin then re-serializes a
+  # body with no `messages`, and the upstream answers
+  #   HTTP 400 {"error":{"message":"[] is too short - 'messages'"}}
+  # Measured on /v1/ornith/chat/completions: 10588 B -> 200, 11088 B -> 400.
+  # An agent request carrying tool schemas clears that in one turn, so the
+  # buffer has to hold a whole conversation, not a chat message.
+  nginx_http_client_body_buffer_size: "16m"
+  nginx_http_client_max_body_size: "16m"
 
 ingressController:
   enabled: true
diff --git a/k8s/apps/api/model-auth.yaml b/k8s/apps/api/model-auth.yaml
index 357b22e..c796cf7 100644
--- a/k8s/apps/api/model-auth.yaml
+++ b/k8s/apps/api/model-auth.yaml
@@ -24,11 +24,20 @@ credentials:
 # `apikey` header; key_in_bearer accepts `Authorization: Bearer <key>` so any
 # OpenAI-compatible SDK (api_key=..., base_url=https://api.riotpiao.com/v1) works
 # unchanged.
+#
+# Namespace `llm-serving`, not `api`: the ingress controller resolves a
+# `konghq.com/plugins` annotation against the annotated object's OWN namespace,
+# and all five model routes in llm-routes.yaml live in llm-serving. While this
+# sat in `api` the reference dangled, the plugin never bound, and every model
+# route served traffic with no key at all — verified: an unauthenticated
+# /v1/models and /v1/ornith/chat/completions both returned 200. A dangling
+# plugin reference is silent; it fails open, so re-test without a key after any
+# move rather than trusting that the object exists.
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
   name: model-key-auth
-  namespace: api
+  namespace: llm-serving
 plugin: key-auth
 config:
   key_names: