diff --git a/tenants/plataforma/20-keycloak.yaml b/tenants/plataforma/20-keycloak.yaml
index 30b3819..aa7fbc6 100644
--- a/tenants/plataforma/20-keycloak.yaml
+++ b/tenants/plataforma/20-keycloak.yaml
@@ -24,7 +24,9 @@ spec:
       containers:
         - name: keycloak
           image: quay.io/keycloak/keycloak:26.7.5
-          args: ["start-dev", "--import-realm"]
+          # Modo de PRODUCAO (05/10/2026). Era start-dev: cache e temas sem otimizacao, perfil de desenvolvimento.
+          # Atras do Traefik: HTTP interno + cabecalhos X-Forwarded (KC_PROXY_HEADERS) e hostname fixo.
+          args: ["start", "--import-realm"]
           env:
             - name: KC_DB
               value: postgres
@@ -44,6 +46,9 @@ spec:
                 secretKeyRef:
                   name: keycloak-admin
                   key: password
+            # Uma replica so: cache local, sem tentar formar cluster (JGroups) com ninguem.
+            - name: KC_CACHE
+              value: local
             - name: KC_HEALTH_ENABLED
               value: "true"
             - name: KC_HTTP_ENABLED