diff --git a/k8s/apps/paperless/deployment.yaml b/k8s/apps/paperless/deployment.yaml
index 41b34bc..5d9cc0d 100644
--- a/k8s/apps/paperless/deployment.yaml
+++ b/k8s/apps/paperless/deployment.yaml
@@ -24,6 +24,13 @@ spec:
       labels:
         app: paperless
     spec:
+      # Kubernetes injects legacy Docker-links env vars for every Service in
+      # this namespace (<SVC>_SERVICE_HOST, <SVC>_PORT, ...). The Service here
+      # is named "paperless", so that becomes PAPERLESS_PORT=tcp://<ip>:8000 -
+      # paperless-ngx's own entrypoint reads PAPERLESS_PORT for gunicorn's
+      # bind address, collides, and gunicorn crash-loops on "not a valid port
+      # number". Disable the injection instead of renaming the Service.
+      enableServiceLinks: false
       nodeSelector:
         kubernetes.io/hostname: talos-cp-3
       containers: