diff --git a/apps/nextcloud/values.yaml b/apps/nextcloud/values.yaml
index b73bde1..605d8b0 100644
--- a/apps/nextcloud/values.yaml
+++ b/apps/nextcloud/values.yaml
@@ -109,17 +109,29 @@ resources:
      cpu: 1000m
      memory: 2Gi
 
+# `redis:` is purely the chart's BUNDLED subchart dependency toggle (its
+# schema is auth/image/master/replica passthrough to the redis-21.1.3
+# subchart, verified via `helm show values nextcloud/nextcloud`) - it has
+# no `host` field, and setting enabled: true here deploys a second, unused
+# Redis (nextcloud-redis-replicas StatefulSet) alongside the real one.
+# Found 2026-08-18: that bundled StatefulSet had been crash-looping on
+# failed liveness probes the whole time, and the `host`/`existingSecret`
+# keys previously set here were silently ignored (not valid subchart
+# keys) - meaning Nextcloud's actual config.php may never have been
+# correctly pointed at the redis-operator instance at all. The correct
+# key for "use an external Redis" is the separate `externalRedis:` block
+# below.
 redis:
-   # Was disabled; now points at the standalone Redis CR (redis-operator) in
-   # apps/nextcloud/manifests/redis-cr.yaml instead of the chart's bundled
-   # subchart - fixes Nextcloud's file-locking/caching as a side benefit of
-   # this migration. Verify these key names against `helm show values
-   # nextcloud/nextcloud` for the deployed chart version before applying.
+   enabled: false
+
+externalRedis:
    enabled: true
    host: redis-nextcloud
-   port: 6379
-   existingSecret: redis-nextcloud-secret
-   existingSecretPasswordKey: password
+   port: "6379"
+   existingSecret:
+      enabled: true
+      secretName: redis-nextcloud-secret
+      passwordKey: password
 
 metrics:
    enabled: false