diff --git a/k8s/infra/iam/zitadel-values.yaml b/k8s/infra/iam/zitadel-values.yaml
index b3e3dbc..d5b15eb 100644
--- a/k8s/infra/iam/zitadel-values.yaml
+++ b/k8s/infra/iam/zitadel-values.yaml
@@ -88,6 +88,14 @@ initJob:
   command: "zitadel"
   activeDeadlineSeconds: 600
 
+# The setup job runs the full first-instance creation: schema migrations, the
+# system org, the iam-admin machine key, and 13 projection replays. The chart
+# default killed it at ~5.5 minutes on 2026-10-25 while it was still replaying
+# projections.projects4, which failed the whole sync. 20 minutes leaves room for
+# a cold database without masking a genuine hang.
+setupJob:
+  activeDeadlineSeconds: 1200
+
 # Two API replicas: the read path survives one node drain, and both share the
 # same masterkey and database. The login UI stays at one replica — a session
 # cookie is not shared, so a second pod buys nothing.