diff --git a/chart/templates/deployment/_icc.yaml b/chart/templates/deployment/_icc.yaml
index 2dd9d01..8369cfc 100644
--- a/chart/templates/deployment/_icc.yaml
+++ b/chart/templates/deployment/_icc.yaml
@@ -139,6 +139,10 @@ spec:
             - name: PLT_SKEW_COOKIE_MAX_AGE
               value: "{{ . }}"
             {{- end }}
+            {{- with dig "features" "skew_protection" "default_routing_mode" nil . }}
+            - name: PLT_SKEW_DEFAULT_ROUTING_MODE
+              value: "{{ . }}"
+            {{- end }}
             - name: DEV_K8S
               value: '{{ dig "features" "dev_mode" "enable" false . | toString }}'
 
diff --git a/chart/values.yaml b/chart/values.yaml
index 4e93394..0d36f6e 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -93,6 +93,25 @@ services:
         check_interval_ms: 60000             # How often to check draining versions (1 min)
         traffic_window_ms: 1800000           # Time window for traffic activity tracking (30 min)
         cookie_max_age: 43200                # Max age for session cookie in seconds (12h)
+        # How clients carry their version: `query` (the default -- a ?dpl baked
+        # into the built assets) or `cookie` (the gateway sets __plt_dpl).
+        # This is the cluster default; an application can override it in ICC.
+        # It exists because both reasons for needing `cookie` -- a gateway that
+        # cannot match query params, or a build pipeline that cannot stamp the
+        # id -- are usually properties of the cluster rather than of one app.
+        #
+        # The two are strictly exclusive and there is NO fallback between them.
+        # In query mode a version whose image was not built with its own id as
+        # PLT_DEPLOYMENT_ID gets no pinning rule at all -- it is unprotected, not
+        # silently downgraded to a cookie. Set `cookie` if your builds do not
+        # pass PLT_DEPLOYMENT_ID yet.
+        #
+        # `query` also requires a gateway controller that implements queryParams
+        # matching. That is Extended support in the Gateway API, not Core, so a
+        # fully conformant controller may lack it -- check that yours reports the
+        # HTTPRouteQueryParamMatching conformance feature. Verified on Envoy
+        # Gateway v1.4.2. Cookie mode has no such prerequisite.
+        default_routing_mode: query
 
     # Available levels: debug, info, warn, error
     log_level: warn