diff --git a/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml b/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml
index f270b1e..f9dd8e0 100644
--- a/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml
+++ b/infrastructure/authentik/manifests/ha-postgres-peerauth.yaml
@@ -38,3 +38,14 @@ spec:
   portLevelMtls:
     "5432":
       mode: PERMISSIVE
+    # Multi-site active failover pilot, floating hostname (see
+    # infrastructure/authentik/manifests/ha-postgres-nodeport.yaml): the
+    # ha-authentik-postgres Service also listens on 61432 (-> targetPort
+    # 5432, same pods) so home's own pods can reach it via the
+    # pg-authentik.ha.huskypup.net CoreDNS rewrite on the same port the
+    # app tier is configured with externally. Needed its own PERMISSIVE
+    # entry - confirmed live 2026-08-20 that ambient's port-level mTLS
+    # enforcement is keyed on the port actually dialed (61432), not just
+    # the pod's real containerPort (5432) it eventually reaches.
+    "61432":
+      mode: PERMISSIVE
diff --git a/infrastructure/istio/manifests/mesh/authorization-policies.yaml b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
index c025e06..49a4149 100644
--- a/infrastructure/istio/manifests/mesh/authorization-policies.yaml
+++ b/infrastructure/istio/manifests/mesh/authorization-policies.yaml
@@ -131,6 +131,7 @@ spec:
         - operation:
             ports:
               - "5432"
+              - "61432" # floating-hostname port, see ha-postgres-peerauth.yaml
 
 ---
 # --- Grafana: Allow ingress + Prometheus datasource queries + scraping ---