diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 6fa792b..146d82a 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -143,6 +143,7 @@ server:
     failureThreshold: 6
   startupProbe:
     timeoutSeconds: 15
+    failureThreshold: 120  # 120 × 10s = 20min for fresh DB migrations
   # Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
   # its request latency/error rate explains SSO-driven slowness on those services.
   metrics: