diff --git a/infrastructure/authentik/manifests/cnpg-cluster.yaml b/infrastructure/authentik/manifests/cnpg-cluster.yaml
index 35c8220..b95b1c0 100644
--- a/infrastructure/authentik/manifests/cnpg-cluster.yaml
+++ b/infrastructure/authentik/manifests/cnpg-cluster.yaml
@@ -99,7 +99,31 @@ spec:
   # route (same path used for MinIO/CrowdSec backups all session) - no
   # UniFi port-forward needed for this direction, only the reverse
   # (VPS/witness reaching INTO home) needed that.
+  # CNPG's distributed-topology validation requires both replica.self and
+  # replica.primary to reference names present in THIS cluster's OWN
+  # externalClusters list - including a self-referencing entry (confirmed
+  # live: "External cluster home not found" until one was added, even
+  # though "home" is this very cluster). The "home" entry's
+  # connectionParameters point at its own local -rw service - never
+  # actually dialed while primary: home (that's this cluster), it only
+  # exists to satisfy the name-reference validation.
   externalClusters:
+    - name: home
+      connectionParameters:
+        host: pg-authentik-rw
+        port: "5432"
+        dbname: app
+        user: streaming_replica
+        sslmode: verify-ca
+      sslCert:
+        name: pg-authentik-replication
+        key: tls.crt
+      sslKey:
+        name: pg-authentik-replication
+        key: tls.key
+      sslRootCert:
+        name: pg-authentik-ca
+        key: ca.crt
     - name: vps
       connectionParameters:
         host: 100.108.113.41
@@ -120,9 +144,11 @@ spec:
   # Distributed topology: both sides agree home is primary today. Failover
   # flips the VPS's replica.primary to "vps" (+ promotion token) - see the
   # plan doc's failover-watcher section. Failback is the same in reverse,
-  # deliberately manual.
+  # deliberately manual. No replica.enabled here - that flag belongs to
+  # CNPG's older single-source replica-cluster mode and is mutually
+  # exclusive with primary/self (confirmed live: "replica mode enabled is
+  # not compatible with the primary field").
   replica:
     self: home
     primary: home
-    source: vps  # where home would replicate FROM if it were ever a replica (not active now - primary: home)
 
diff --git a/infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml b/infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
index 5d7aad8..777118c 100644
--- a/infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
+++ b/infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
@@ -68,7 +68,7 @@ spec:
 
   bootstrap:
     recovery:
-      source: home-backup
+      source: home
 
   # Multi-site active failover pilot (see
   # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - the
@@ -90,11 +90,25 @@ spec:
   # just the VPS and witness public IPs. NOT the Netbird mesh directly -
   # UniFi has no route to that CIDR, confirmed live (see
   # infrastructure/ha-failover/manifests/etcd.yaml for the full story).
+  # externalClusters[].name is now "home" (was "home-backup") - reused
+  # consistently for bootstrap.recovery.source, replica.primary, AND the
+  # connectionParameters below, since CNPG's distributed-topology
+  # validation requires replica.primary to match an externalClusters name
+  # exactly (confirmed live: "External cluster home not found" when it
+  # didn't). serverName inside barmanObjectStore is unaffected by this
+  # rename - it's an explicit separate override, not derived from the
+  # entry name.
+  #
+  # Also needs a self-referencing "vps" entry below (same reason -
+  # replica.self must match an externalClusters name too, even though
+  # it's this very cluster) - its connectionParameters point at VPS's own
+  # local -rw service, never actually dialed while this cluster is a
+  # replica.
   externalClusters:
-    - name: home-backup
+    - name: home
       barmanObjectStore:
-        # serverName defaults to the externalClusters[].name ("home-backup")
-        # here, NOT the source Postgres cluster's actual name - but home's
+        # serverName defaults to the externalClusters[].name here, NOT
+        # the source Postgres cluster's actual name - but home's
         # barmanObjectStore backup: block (on the pg-authentik Cluster
         # itself) defaults serverName to its own metadata.name
         # ("pg-authentik"). Without this override, recovery looks for
@@ -126,13 +140,32 @@ spec:
       sslRootCert:
         name: pg-authentik-home-ca
         key: ca.crt
+    - name: vps
+      connectionParameters:
+        host: pg-authentik-rw
+        port: "5432"
+        dbname: app
+        user: streaming_replica
+        sslmode: verify-ca
+      sslCert:
+        name: pg-authentik-replication
+        key: tls.crt
+      sslKey:
+        name: pg-authentik-replication
+        key: tls.key
+      sslRootCert:
+        name: pg-authentik-ca
+        key: ca.crt
 
-  # Distributed topology: both sides agree home is primary today.
+  # Distributed topology: both sides agree home is primary today. No
+  # replica.enabled - that flag belongs to CNPG's older single-source
+  # replica-cluster mode and is mutually exclusive with primary/self
+  # (confirmed live: "replica mode enabled is not compatible with the
+  # primary field").
   replica:
-    enabled: true
     self: vps
     primary: home
-    source: home-backup
+    source: home
 
   monitoring:
     enablePodMonitor: false  # no Prometheus on the VPS cluster