diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index aff66dd02..076274558 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,9 +1,26 @@
+# Code owners for rossoctl/cortex.
+#
+# Owners here are DERIVED from the project's source of truth for maintainership:
+#   https://github.com/rossoctl/rossoctl/blob/main/MAINTAINERS.md
+#
+# CODEOWNERS cannot reference that file, or any file: GitHub accepts only user and team
+# handles, and it is read only from this repository's root, .github/ or docs/ -- there is no
+# inheritance from rossoctl/rossoctl to lean on. So these names are a copy, and they have to
+# be updated when MAINTAINERS.md changes.
+#
+# A rule naming a user or team that does not exist, or that lacks write access here, is
+# ignored -- the matched paths end up with no owner. GitHub reports this only in the file
+# view and via the API; after editing, `gh api repos/rossoctl/cortex/codeowners/errors`
+# must return an empty list. That one call checks existence, visibility and write access
+# for every handle in this file.
+
 # Default owners for everything. The AuthBridge components used to carry their
 # own rule for authbridge/; that tree is now the repo root, so `*` covers it.
 * @rossoctl/maintainers
 
-# CI/CD and GitHub configuration
-.github/ @rossoctl/platform
+# CI/CD and GitHub configuration, owned per MAINTAINERS.md (Cortex proxy & plugin
+# pipeline; org-wide CI & repo governance).
+.github/ @huang195 @rubambiza
 
 # Documentation
 *.md @rossoctl/maintainers