diff --git a/infrastructure/vps-standby/authentik/values.yaml b/infrastructure/vps-standby/authentik/values.yaml
index 25e5cff..14e8a99 100644
--- a/infrastructure/vps-standby/authentik/values.yaml
+++ b/infrastructure/vps-standby/authentik/values.yaml
@@ -60,6 +60,23 @@ global:
 
 server:
   replicas: 1
+  # Default failureThreshold: 3 (40s runway) is too strict running against
+  # a read-only CNPG replica - the worker constantly retries a scheduled-
+  # task query that needs a write lock (harmless, expected, logged as
+  # 'cannot execute SELECT FOR UPDATE in a read-only transaction'), and
+  # any transient DB hiccup during that trips the server's health check
+  # and gets it killed (confirmed live: CrashLoopBackOff, 'connection
+  # refused' during a brief blip). Widened so brief hiccups don't kill it.
+  livenessProbe:
+    failureThreshold: 10
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 5
+  readinessProbe:
+    failureThreshold: 10
+    initialDelaySeconds: 10
+    periodSeconds: 10
+    timeoutSeconds: 5
   containerSecurityContext:
     runAsNonRoot: true
     allowPrivilegeEscalation: false