diff --git a/workloads/ecommerce/commerce/kustomization.yaml b/workloads/ecommerce/commerce/kustomization.yaml
index b607179..3ff2459 100644
--- a/workloads/ecommerce/commerce/kustomization.yaml
+++ b/workloads/ecommerce/commerce/kustomization.yaml
@@ -7,5 +7,5 @@ resources:
   - redis.yaml
   - minio.yaml
   - minio-bootstrap-job.yaml
-  - medusa.yaml
+  - medusa/
   - ingress-commerce.yaml
diff --git a/workloads/ecommerce/commerce/medusa/kustomization.yaml b/workloads/ecommerce/commerce/medusa/kustomization.yaml
new file mode 100644
index 0000000..3fd3017
--- /dev/null
+++ b/workloads/ecommerce/commerce/medusa/kustomization.yaml
@@ -0,0 +1,62 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ecommerce
+
+# Solo Deployment + Service -- el Ingress de commerce vive en
+# ingress-commerce.yaml dentro de workloads/ecommerce/commerce/,
+# separado de este Deployment/Service, no le toca al overlay.
+resources:
+  - https://gitea.cruzcloud.net/devops/platform-templates.git//k8s-manifests/base?ref=main
+
+patches:
+  # medusa no tiene Ingress propio (el commerce-ingress vive aparte,
+  # en workloads/ecommerce/commerce/ingress-commerce.yaml) -- mismo
+  # patrón que frontend, borrar el Ingress genérico del base.
+  - target:
+      kind: Ingress
+      name: app-ingress
+    patch: |-
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: app-ingress
+
+  - target:
+      kind: Deployment
+      name: app-deployment
+    path: patches/deployment.yaml
+  - target:
+      kind: Service
+      name: app-svc
+    path: patches/service.yaml
+
+  - target:
+      kind: Deployment
+      name: app-deployment
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: medusa-deploy
+      - op: replace
+        path: /spec/template/spec/containers/0/ports
+        value:
+          - name: http
+            containerPort: 9000
+  - target:
+      kind: Service
+      name: app-svc
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: medusa-svc
+      # Mismo motivo que el ports de la Deployment: el puerto de Medusa
+      # (9000) no coincide con el default del base (80), así que un
+      # patch de merge normal duplica en vez de reemplazar.
+      - op: replace
+        path: /spec/ports
+        value:
+          - name: http
+            port: 9000
+            targetPort: 9000
diff --git a/workloads/ecommerce/commerce/medusa.yaml b/workloads/ecommerce/commerce/medusa/patches/deployment.yaml
similarity index 67%
rename from workloads/ecommerce/commerce/medusa.yaml
rename to workloads/ecommerce/commerce/medusa/patches/deployment.yaml
index 628060b..223c3f7 100644
--- a/workloads/ecommerce/commerce/medusa.yaml
+++ b/workloads/ecommerce/commerce/medusa/patches/deployment.yaml
@@ -1,7 +1,9 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: medusa-deploy
+  name: app-deployment
+  labels:
+    app: medusa
 spec:
   replicas: 1
   strategy:
@@ -17,9 +19,20 @@ spec:
       labels:
         app: medusa
     spec:
-      imagePullSecrets:
-        - name: gitea-registry-secret
-
+      # runAsNonRoot solo no alcanza si el USER de la imagen es un
+      # nombre, no un UID -- confirmado en vivo migrando frontend
+      # (mismo problema exacto, error real: "cannot verify user is
+      # non-root"). Acá el Dockerfile usa el usuario "node" que ya trae
+      # la imagen base node:22.18.0-bookworm-slim -- confirmado con
+      # `docker run ... id node` antes de asumir el UID: 1000.
+      securityContext:
+        runAsUser: 1000
+      # Workaround del blackhole MTU/PMTUD cross-node (ver
+      # docs/known-issues.md en apps-registry) -- ya no es
+      # estrictamente necesario (el fix real de fondo se aplicó
+      # 2026-08-16), pero se deja como red de contención a propósito.
+      # No es un campo del base -- se agrega entero acá, es aditivo,
+      # no pisa nada.
       affinity:
         podAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -54,10 +67,6 @@ spec:
         - name: migrations
           image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.112
           imagePullPolicy: IfNotPresent
-          # node directo, sin npx: la imagen ya no trae npm (ver
-          # Dockerfile de commerce-backend, remediacion de
-          # CVE-2026-59873) -- mismo binario que ya invoca el CMD de
-          # runtime de esa misma imagen.
           command:
             - node
             - node_modules/@medusajs/cli/dist/index.js
@@ -76,7 +85,7 @@ spec:
               memory: 768Mi
 
       containers:
-        - name: medusa
+        - name: app
           image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.112
           imagePullPolicy: IfNotPresent
           envFrom:
@@ -84,9 +93,6 @@ spec:
                 name: commerce-config
             - secretRef:
                 name: commerce-secrets
-          ports:
-            - name: http
-              containerPort: 9000
           readinessProbe:
             httpGet:
               path: /health
@@ -103,6 +109,16 @@ spec:
             periodSeconds: 20
             timeoutSeconds: 5
             failureThreshold: 6
+          # Puerto 9000, no privilegiado -- a diferencia de
+          # frontend/docs-portal, acá el drop: ALL del base no
+          # necesita ningún add de vuelta. Medusa ya corre como
+          # usuario "node" no-root (ver Dockerfile de commerce-backend).
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
           resources:
             requests:
               cpu: 150m
@@ -110,15 +126,3 @@ spec:
             limits:
               cpu: 750m
               memory: 1Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: medusa-svc
-spec:
-  selector:
-    app: medusa
-  ports:
-    - name: http
-      port: 9000
-      targetPort: 9000
diff --git a/workloads/ecommerce/commerce/medusa/patches/service.yaml b/workloads/ecommerce/commerce/medusa/patches/service.yaml
new file mode 100644
index 0000000..19f6bb9
--- /dev/null
+++ b/workloads/ecommerce/commerce/medusa/patches/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: app-svc
+spec:
+  selector:
+    app: medusa
+  ports:
+    - name: http
+      port: 9000
+      targetPort: 9000