diff --git a/terraform/platform/main.tf b/terraform/platform/main.tf
index 8716520..e807a4b 100644
--- a/terraform/platform/main.tf
+++ b/terraform/platform/main.tf
@@ -29,6 +29,13 @@ provider "aws" {
   region = "us-east-1"
 }
 
+# v1.14 (REQ-154): VPC CIDR is parameterized (default 10.0.0.0/16).
+variable "vpc_cidr" {
+  description = "CIDR block for the shared platform VPC (default 10.0.0.0/16)."
+  type        = string
+  default     = "10.0.0.0/16"
+}
+
 # KMS customer-managed key for DynamoDB SSE + SSM Parameter Store encryption
 resource "aws_kms_key" "acdl_platform" {
   description             = "ACDL platform KMS key (DynamoDB SSE + SSM + Secrets Manager)"
@@ -252,7 +259,7 @@ output "acdl_sod_halt_topic_arn" {
 # ---------------------------------------------------------------------------
 
 resource "aws_vpc" "acdl_shared" {
-  cidr_block = "10.0.0.0/16"
+  cidr_block = var.vpc_cidr
   tags = {
     Name               = "acdl-shared"
     "acdl:owner"       = "acdl"
@@ -263,7 +270,7 @@ resource "aws_vpc" "acdl_shared" {
 }
 
 resource "aws_subnet" "acdl_shared" {
-  count             = 2
+  count             = length(data.aws_availability_zones.available.names)
   vpc_id            = aws_vpc.acdl_shared.id
   cidr_block        = cidrsubnet(aws_vpc.acdl_shared.cidr_block, 8, count.index + 1)
   availability_zone = data.aws_availability_zones.available.names[count.index]
@@ -317,6 +324,10 @@ resource "aws_security_group" "ecs" {
   description = "Security group for ECS Fargate services (platform VPC)"
   vpc_id      = aws_vpc.acdl_shared.id
 
+  # Ingress on port 80 is open to 0.0.0.0/0 — this is acceptable because
+  # the ECS service is fronted by a public-facing ALB (the ALB terminates
+  # TLS + routes to the target group). The ECS SG should not be attached
+  # directly to resources without an ALB in front. v1.14 (REQ-154).
   ingress {
     from_port   = 80
     to_port     = 80