diff --git a/k8s/apps/immich/db.yaml b/k8s/apps/immich/db.yaml
index ac3fbc2..112db47 100644
--- a/k8s/apps/immich/db.yaml
+++ b/k8s/apps/immich/db.yaml
@@ -32,6 +32,14 @@ spec:
       encoding: UTF8
       localeCollate: C
       localeCType: C
+      # CREATE EXTENSION vector requires superuser (pgvector's control file
+      # isn't marked trusted) and the "app" owner role isn't one
+      # (enableSuperuserAccess: false, repo convention) - postInitApplicationSQL
+      # runs as superuser during initdb, before the app ever connects. Only
+      # fires on a fresh bootstrap; the live cluster already had this run
+      # manually once (kubectl exec ... psql -U postgres -c 'CREATE EXTENSION').
+      postInitApplicationSQL:
+        - "CREATE EXTENSION IF NOT EXISTS vector;"
   enableSuperuserAccess: false
   resources:
     requests: { memory: "512Mi", cpu: "250m" }