diff --git a/infrastructure/authentik/manifests/ha-postgres-nodeport.yaml b/infrastructure/authentik/manifests/ha-postgres-nodeport.yaml
index 781ba7a..67dfa48 100644
--- a/infrastructure/authentik/manifests/ha-postgres-nodeport.yaml
+++ b/infrastructure/authentik/manifests/ha-postgres-nodeport.yaml
@@ -6,6 +6,18 @@
 # object and won't fight with it. Needs
 # infrastructure/kyverno/policies/ha-failover-nodeport-exception.yaml
 # (disallow-nodeport-services is enforced cluster-wide otherwise).
+#
+# Second port (61432, ClusterIP only - no nodePort needed) added for the
+# CoreDNS rewrite in infrastructure/coredns/manifests/: home's own pods
+# resolving pg-authentik.ha.huskypup.net rewrite to THIS service (not
+# CNPG's own pg-authentik-rw) specifically so they can reach it on the
+# SAME port number the app tier is configured with (61432, matching the
+# external floating hostname's port - see infrastructure/authentik/
+# values.yaml's AUTHENTIK_POSTGRESQL__PORT) - CoreDNS rewrite only
+# changes the resolved NAME, not the port the client then connects to,
+# so the target service has to actually listen on that same port too, or
+# the connection times out even though DNS resolves correctly (confirmed
+# live 2026-08-20).
 apiVersion: v1
 kind: Service
 metadata:
@@ -17,6 +29,10 @@ spec:
     cnpg.io/cluster: pg-authentik
     cnpg.io/instanceRole: primary
   ports:
-    - port: 5432
+    - name: nodeport-5432
+      port: 5432
       targetPort: 5432
       nodePort: 32432
+    - name: floating-port-61432
+      port: 61432
+      targetPort: 5432