diff --git a/k8s/bootstrap/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml
index 7901322..8872083 100644
--- a/k8s/bootstrap/ingress/nginx-values.yaml
+++ b/k8s/bootstrap/ingress/nginx-values.yaml
@@ -75,4 +75,4 @@ controller:
       enabled: true
       namespace: ingress-nginx
       interval: 30s
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
diff --git a/k8s/platform/monitoring/prometheus-values.yaml b/k8s/platform/monitoring/prometheus-values.yaml
index 6e2923e..47a819d 100644
--- a/k8s/platform/monitoring/prometheus-values.yaml
+++ b/k8s/platform/monitoring/prometheus-values.yaml
@@ -29,9 +29,10 @@ prometheus:
     retention: 15d
     retentionSize: "18GB"
 
-    # Scrape timeout: increased to 60s to tolerate 5+ second network latency spikes
-    # Default: 10s — too aggressive for latency-prone clusters
-    scrapeInterval: 30s
+    # scrapeTimeout MUST be <= scrapeInterval or the operator refuses to generate
+    # the Prometheus config ("scrapeTimeout greater than scrapeInterval") and no
+    # STS is created. Use a larger interval to keep the 60s timeout headroom.
+    scrapeInterval: 60s
     scrapeTimeout: 60s
     evaluationInterval: 30s
 
diff --git a/k8s/security/iam/authentik-values.yaml b/k8s/security/iam/authentik-values.yaml
index 392af6b..9e34a96 100644
--- a/k8s/security/iam/authentik-values.yaml
+++ b/k8s/security/iam/authentik-values.yaml
@@ -133,7 +133,7 @@ server:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── Authentik worker ──────────────────────────────────────────────────────────
 # Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
@@ -169,7 +169,7 @@ worker:
     enabled: true
     serviceMonitor:
       enabled: true
-      scrapeTimeout: 60s
+      scrapeTimeout: 30s
 
 # ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
 # Authentik connects to the centralized ddb-cluster (1 primary + 2 replicas with pgvector).