diff --git a/cluster-talos/kubernetes/infrastructure/platform/kustomization.yaml b/cluster-talos/kubernetes/infrastructure/platform/kustomization.yaml
index 2faab0f3..d3872141 100644
--- a/cluster-talos/kubernetes/infrastructure/platform/kustomization.yaml
+++ b/cluster-talos/kubernetes/infrastructure/platform/kustomization.yaml
@@ -13,7 +13,8 @@ resources:
   - external-dns/external-dns-cloudflare/ks.yaml
   - cloudflare-operator-system/cloudflare-operator/ks.yaml
   - cloudflare-operator-system/cloudflare-tunnel/ks.yaml
-  - logging/ks.yaml
+  - logging/logging-operator/ks.yaml
+  - logging/logging-config/ks.yaml
   - kasten-io/ks.yaml
   - spegel/ks.yaml
   - renovate/ks.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/kustomization.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/app/kustomization.yaml
deleted file mode 100644
index 63035bb4..00000000
--- a/cluster-talos/kubernetes/infrastructure/platform/logging/app/kustomization.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helmrelease-operator.yaml
-  # Order below matters at first apply: the operator's CRDs (Logging,
-  # Flow, ClusterFlow, Output, ClusterOutput) must exist before the
-  # CRs below can install. Flux retries on missing-CRD failures, so
-  # this resolves on the second reconcile if both arrive together.
-  - logging.yaml
-  - clusteroutput-vcflogs.yaml
-  - clusterflow-all.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/ks.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/ks.yaml
deleted file mode 100644
index 4ed141fe..00000000
--- a/cluster-talos/kubernetes/infrastructure/platform/logging/ks.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: logging
-  namespace: flux-system
-spec:
-  interval: 1h
-  dependsOn:
-    - name: configs
-  path: ./cluster-talos/kubernetes/infrastructure/platform/logging/app
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  postBuild:
-    substituteFrom:
-      - kind: Secret
-        name: cluster-vars
-  wait: true
-  timeout: 5m
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/README.md b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/README.md
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/README.md
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/README.md
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/clusterflow-all.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/clusterflow-all.yaml
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/clusterflow-all.yaml
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/clusterflow-all.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/clusteroutput-vcflogs.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/clusteroutput-vcflogs.yaml
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/clusteroutput-vcflogs.yaml
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/clusteroutput-vcflogs.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/kustomization.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/kustomization.yaml
new file mode 100644
index 00000000..ca82b3f8
--- /dev/null
+++ b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - logging.yaml
+  - clusteroutput-vcflogs.yaml
+  - clusterflow-all.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/logging.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/logging.yaml
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/logging.yaml
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app/logging.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/ks.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/ks.yaml
new file mode 100644
index 00000000..97645b74
--- /dev/null
+++ b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/ks.yaml
@@ -0,0 +1,29 @@
+---
+# logging-config — declares the actual logging pipeline (Logging,
+# ClusterFlow, ClusterOutput CRs) on top of the operator's CRDs.
+#
+# Depends on `logging-operator` so Flux waits for the chart's
+# HelmRelease to land + the CRDs to register before applying these
+# CRs. Without this split, the kustomization failed on first apply
+# with "no matches for kind Logging in version
+# logging.banzaicloud.io/v1beta1".
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: logging-config
+  namespace: flux-system
+spec:
+  interval: 1h
+  dependsOn:
+    - name: logging-operator
+  path: ./cluster-talos/kubernetes/infrastructure/platform/logging/logging-config/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: cluster-vars
+  wait: true
+  timeout: 5m
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/helmrelease-operator.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/helmrelease-operator.yaml
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/helmrelease-operator.yaml
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/helmrelease-operator.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/kustomization.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/kustomization.yaml
new file mode 100644
index 00000000..1eb2c306
--- /dev/null
+++ b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrelease-operator.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/app/namespace.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/namespace.yaml
similarity index 100%
rename from cluster-talos/kubernetes/infrastructure/platform/logging/app/namespace.yaml
rename to cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app/namespace.yaml
diff --git a/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/ks.yaml b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/ks.yaml
new file mode 100644
index 00000000..6bcaced9
--- /dev/null
+++ b/cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/ks.yaml
@@ -0,0 +1,24 @@
+---
+# logging-operator — installs the Kube Logging Operator HelmRelease.
+# This ks owns the operator deployment + the CRDs it ships
+# (Logging, ClusterFlow, ClusterOutput, FluentbitAgent, etc.).
+#
+# Split from `logging-config` because the CRs in that sister ks
+# can't apply until these CRDs exist. Mirrors the
+# cert-manager / certs split pattern already used in this repo.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: logging-operator
+  namespace: flux-system
+spec:
+  interval: 1h
+  dependsOn:
+    - name: configs
+  path: ./cluster-talos/kubernetes/infrastructure/platform/logging/logging-operator/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  wait: true
+  timeout: 5m