diff --git a/k8s/applications/temporal/temporal-values.yaml b/k8s/applications/temporal/temporal-values.yaml
index 952eed3..7d44ee9 100644
--- a/k8s/applications/temporal/temporal-values.yaml
+++ b/k8s/applications/temporal/temporal-values.yaml
@@ -43,19 +43,20 @@ grafana:
   enabled: false
 
 # ── Schema setup/update Jobs ──────────────────────────────────────────────────
-# Disabled: ddb-cluster's seed job (k8s/data/db-init-job.yaml) already creates
-# the `temporal` and `temporal_visibility` databases and runs the Temporal
-# schema migrations out of band. Leaving these at their chart default (true)
-# would spin up a schema Job on every sync that tries to wait-for-cassandra
-# and run cassandra-tool commands (see note above) - pointless for us even
-# once correctly pointed at Postgres, since schema is already seeded.
+# The `temporal` and `temporal_visibility` databases are provisioned
+# declaratively by CNPG Database CRs (k8s/data/temporal-database.yaml,
+# temporal-visibility-database.yaml), so createDatabase stays disabled (the
+# `temporal` role also lacks CREATEDB). setup/update run temporal-sql-tool as
+# the `temporal` owner against those existing DBs to install and migrate the
+# Temporal server schema — without them both DBs have zero tables and the
+# server dies on "no usable database connection found" (no schema_version row).
 schema:
   createDatabase:
     enabled: false
   setup:
-    enabled: false
+    enabled: true
   update:
-    enabled: false
+    enabled: true
 
 # ── Temporal server config (PostgreSQL persistence) ──────────────────────────
 server:
diff --git a/k8s/data/kustomization.yaml b/k8s/data/kustomization.yaml
index 8f46450..94c358c 100644
--- a/k8s/data/kustomization.yaml
+++ b/k8s/data/kustomization.yaml
@@ -16,5 +16,6 @@ resources:
   - forgejo-database.yaml
   - authentik-database.yaml
   - temporal-database.yaml
+  - temporal-visibility-database.yaml
 # db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
 # NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.
diff --git a/k8s/data/temporal-visibility-database.yaml b/k8s/data/temporal-visibility-database.yaml
new file mode 100644
index 0000000..4ec95c0
--- /dev/null
+++ b/k8s/data/temporal-visibility-database.yaml
@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: temporal-visibility
+  namespace: ddb
+spec:
+  name: temporal_visibility
+  owner: temporal
+  cluster:
+    name: ddb-cluster