diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml
index e5df54aaf..58ed369c0 100644
--- a/packages/core/platform/templates/bundles/system.yaml
+++ b/packages/core/platform/templates/bundles/system.yaml
@@ -186,11 +186,14 @@
        present-on-cluster Package. ouroboros keeps running, the
        cleanup hook never fires, the rewrite block stays live. The
        operator must `kubectl delete package.cozystack.io
-       cozystack.ouroboros` (or add the package to
-       bundles.disabledPackages) for the chart to actually uninstall
-       and the hook to actually clean up. This guard fails the render
-       on the dangerous transition path so the operator confirms
-       they understand the asymmetry by setting
+       cozystack.ouroboros` for the chart to actually uninstall and
+       the hook to actually clean up. Adding the name to
+       bundles.disabledPackages is not a second path to that: it only
+       stops _helpers.tpl emitting the Package document, which is the
+       same suppression the flag flip already performs, and
+       resource-policy: keep leaves the live Package running. This
+       guard fails the render on the dangerous transition path so the
+       operator confirms they understand the asymmetry by setting
        publishing.proxyProtocolAcknowledgeUnclean: true.
        Known hole: an operator who manually `kubectl delete package
        cozystack.ouroboros` before flipping the flag back bypasses the
diff --git a/packages/core/platform/tests/bundles_proxy_protocol_lookup_test.yaml b/packages/core/platform/tests/bundles_proxy_protocol_lookup_test.yaml
index fc6cee8a1..a0751ee00 100644
--- a/packages/core/platform/tests/bundles_proxy_protocol_lookup_test.yaml
+++ b/packages/core/platform/tests/bundles_proxy_protocol_lookup_test.yaml
@@ -78,3 +78,23 @@ tests:
           path: metadata.annotations["helm.sh/resource-policy"]
           value: keep
 
+  # bundles.disabledPackages is not a route out of the guard. A name in
+  # that list only stops _helpers.tpl emitting the Package document; the
+  # guard keys off a lookup for the live Package CR, which the list
+  # never touches. An operator who reaches for disabledPackages instead
+  # of `kubectl delete package` still gets the failure, and ouroboros is
+  # still installed when they get it.
+  - it: still fails when cozystack.ouroboros is in bundles.disabledPackages but the Package CR is live
+    set:
+      bundles:
+        system:
+          enabled: true
+          variant: isp-full
+        disabledPackages:
+          - cozystack.ouroboros
+      publishing:
+        proxyProtocol: false
+        proxyProtocolAcknowledgeUnclean: false
+    asserts:
+      - failedTemplate:
+          errorPattern: "publishing.proxyProtocol was previously enabled.*helm.sh/resource-policy: keep leaves the existing Package"
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 077213a21..b124bad74 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -259,8 +259,7 @@ publishing:
   #
   #   kubectl delete package.cozystack.io cozystack.ouroboros
   #
-  # or adds the package name to bundles.disabledPackages. THAT is the
-  # path that triggers the chart's pre-delete Helm hook
+  # THAT is the path that triggers the chart's pre-delete Helm hook
   # (charts/ouroboros/templates/coredns-cleanup-hook.yaml, vendored at
   # 0.8.0) — the hook quiesces the controller, sed-strips the
   # BEGIN/END block from the live kube-system/coredns Corefile, and
@@ -269,6 +268,15 @@ publishing:
   # the normal disable path. Documentation of the hook's exact
   # behaviour lives in the upstream chart's README.
   #
+  # bundles.disabledPackages does NOT do this. Putting this name in
+  # that list only makes templates/_helpers.tpl skip emitting the
+  # Package document — the same suppression as leaving proxyProtocol
+  # false — and resource-policy: keep then stops Helm pruning a
+  # Package it no longer renders. The Package CR stays, so does the
+  # HelmRelease it owns, ouroboros keeps running, and the pre-delete
+  # hook never fires. No platform values setting reaches that hook:
+  # the operator has to delete the Package CR.
+  #
   # Manual cleanup recipe (only if the chart's pre-delete hook fails
   # to land — controller pod stuck in CrashLoop blocking the quiesce
   # step, ConfigMap RBAC drift on the namespace, helm uninstall