diff --git a/kubernetes/apps/authentik-db/postgres.yaml b/kubernetes/apps/authentik-db/postgres.yaml
index 291ecc52..27aa8788 100644
--- a/kubernetes/apps/authentik-db/postgres.yaml
+++ b/kubernetes/apps/authentik-db/postgres.yaml
@@ -3,6 +3,14 @@ kind: Cluster
 metadata:
   name: ak-pg
   namespace: authentik
+  annotations:
+    # Archive is pre-populated by the migration seed (base + WAL) and,
+    # on later reboots, by this cluster's own continuous archiving. The
+    # plugin's pre-recovery "Expected empty archive" check conflicts
+    # with the producer==consumer invariant of the symmetric-restore
+    # design, so skip it. bootstrap.recovery still reads latest backup
+    # from the archive; if none, it recovers the migration seed.
+    cnpg.io/skipEmptyWalArchiveCheck: "enabled"
 spec:
   instances: 2
   imageName: ghcr.io/cloudnative-pg/postgresql:16
diff --git a/kubernetes/apps/paperless-db/postgres.yaml b/kubernetes/apps/paperless-db/postgres.yaml
index 2a396763..724b6da5 100644
--- a/kubernetes/apps/paperless-db/postgres.yaml
+++ b/kubernetes/apps/paperless-db/postgres.yaml
@@ -3,6 +3,12 @@ kind: Cluster
 metadata:
   name: pprl-pg
   namespace: paperless
+  annotations:
+    # See authentik-db/postgres.yaml — same rationale: skip the
+    # plugin's pre-recovery "Expected empty archive" check so
+    # bootstrap.recovery works against a pre-populated archive
+    # (migration seed or later live backups).
+    cnpg.io/skipEmptyWalArchiveCheck: "enabled"
 spec:
   instances: 2
   imageName: ghcr.io/cloudnative-pg/postgresql:16