diff --git a/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml b/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
index cca4e91..513a542 100644
--- a/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
+++ b/infrastructure/vps-standby/vault/manifests/restore-cronjob.yaml
@@ -35,7 +35,13 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: ["pods"]
-    verbs: ["get", "list", "delete"]
+    # watch is required by `kubectl wait` - without it the wait's internal
+    # watch retry loop never terminates cleanly even with --timeout set
+    # (confirmed live 2026-08-18: it just kept retrying past the stated
+    # 120s timeout). The restore/unseal steps themselves still succeed
+    # without it - this only affects how gracefully the job detects the
+    # pod coming back before unsealing.
+    verbs: ["get", "list", "watch", "delete"]
   - apiGroups: [""]
     resources: ["pods/exec"]
     verbs: ["create"]