diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 9e34a96..6fa792b 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -127,6 +127,22 @@ server:
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"
+  # The /-/health/{live,ready}/ endpoints do a DB round-trip; under transient
+  # CNPG contention they respond in 5-6s while still returning 200. The chart's
+  # default 3s liveness timeout then flags a working backend as dead and kubelet
+  # kills it in a restart loop — the pod never stays Ready, gets dropped from the
+  # authentik-server Service endpoints, and the OAuth-provisioning PostSync hook
+  # fails with "Host is unreachable". Widen the timeouts so slow-but-healthy
+  # checks aren't treated as failures. (Only these fields are overridden; the
+  # chart deep-merges the rest of each probe, incl. the httpGet path.)
+  livenessProbe:
+    timeoutSeconds: 15
+    failureThreshold: 6
+  readinessProbe:
+    timeoutSeconds: 15
+    failureThreshold: 6
+  startupProbe:
+    timeoutSeconds: 15
   # Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
   # its request latency/error rate explains SSO-driven slowness on those services.
   metrics: