diff --git a/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml b/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
index 513a542..1b76b9e 100644
--- a/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
+++ b/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
@@ -149,7 +149,19 @@ data:
     echo "==> Restarting Vault to fully reload post-restore state..."
     kubectl -n vault delete pod "$VAULT_POD"
     echo "==> Waiting for ${VAULT_POD} to come back..."
-    kubectl -n vault wait --for=condition=Ready "pod/${VAULT_POD}" --timeout=120s || true
+    # Not `kubectl wait --for=condition=Ready` - Vault's readiness probe
+    # requires unsealed state, which only happens in the step AFTER this
+    # wait (chicken-and-egg: it would never report Ready before we've had
+    # a chance to unseal it). Poll for the container process merely being
+    # started instead, which doesn't depend on any readiness probe.
+    for i in $(seq 1 24); do
+      PHASE="$(kubectl -n vault get "pod/${VAULT_POD}" -o jsonpath='{.status.containerStatuses[0].state.running}' 2>/dev/null || echo "")"
+      if [ -n "$PHASE" ]; then
+        echo "==> ${VAULT_POD} container is running."
+        break
+      fi
+      sleep 5
+    done
 
     echo "==> Unsealing with home's real key (restore overwrote the keyring)..."
     for i in 1 2 3 4 5; do