diff --git a/kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml b/kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml
index 7bf8128f..c72126f6 100644
--- a/kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml
+++ b/kubernetes/apps/uptime-monitor/crd-endpointmonitors.yaml
@@ -1,8 +1,17 @@
 # VENDORED, DO NOT EDIT BY HAND.
 #
-# Source: stakater/IngressMonitorController chart 2.2.13,
+# Source: stakater/IngressMonitorController at tag v2.2.13 — the tag the image in
+#   deployment.yaml is pinned to — commit 2deeba188fbd2860d0b3a7c3590a954a1a709924,
 #   charts/ingressmonitorcontroller/crds/endpointmonitor.stakater.com_endpointmonitors.yaml
-# Copied verbatim at commit aaffd8a866aa09a77030979d938e766895bde5d4.
+# Everything below this header is byte-identical to that file: md5
+#   f753baa9c9684002ad01d309e98755ba over `apiVersion:` to EOF. The only edits are
+#   this header and the dropped leading `---`.
+#
+# An earlier revision of this header cited aaffd8a866aa09a77030979d938e766895bde5d4
+# instead. That is a master merge commit dated 2026-09-25, four months after the
+# v2.2.13 tag (2026-05-06). The file content was not affected — the chart CRD is
+# unchanged between the tag and that commit — but a citation pointing at a moving
+# branch cannot be used to check this file against the version actually deployed.
 #
 # Vendored rather than installed via HelmRelease because this Kustomization
 # ships hand-written RBAC (see rbac.yaml) — the chart's own Role grants pods,
diff --git a/kubernetes/apps/uptime-monitor/rbac.yaml b/kubernetes/apps/uptime-monitor/rbac.yaml
index 79203cfd..089ebaa3 100644
--- a/kubernetes/apps/uptime-monitor/rbac.yaml
+++ b/kubernetes/apps/uptime-monitor/rbac.yaml
@@ -15,11 +15,21 @@
 #     `tryGetHealthEndpointFromIngress` (pkg/kube/wrappers/ingress-wrapper.go:126),
 #     which is reached only from the `urlFrom.ingressRef` path and only when the
 #     EndpointMonitor sets no explicit `healthEndpoint`. It is a best-effort
-#     guess at a readiness-probe path: both the Get and the List log the error
-#     and return `"", false` on failure, so a denial costs a log line, not a
-#     reconcile. Since the ingressRef path can only reach this namespace anyway
-#     (see the ingresses rule below) and nothing here serves HTTP, the grant
-#     would be inert. Add it if an Ingress ever lands in `uptime-monitor`.
+#     guess at a readiness-probe path. Omitted because that path cannot reach
+#     anything here: ingressRef resolves against the EndpointMonitor's own
+#     namespace (see the ingresses rule below) and nothing in `uptime-monitor`
+#     serves HTTP, so the grant would be inert.
+#     It does NOT fail gracefully, so grant it BEFORE an Ingress lands in this
+#     namespace, not after the first EndpointMonitor points at one. The function's
+#     own error branches do log-and-continue, but an RBAC denial never reaches
+#     them: the reconciler's client is `mgr.GetClient()` (cmd/main.go:168), the
+#     cache-backed client, so the first Service Get starts an informer and waits
+#     for it to sync on a `context.TODO()` that nothing cancels. A forbidden
+#     list/watch means that sync never completes, the Get never returns, and the
+#     single reconcile worker (`--max-concurrent-reconciles`, default 1,
+#     cmd/main.go:84) stops processing anything at all. `/readyz` is
+#     `healthz.Ping` (cmd/main.go:182) and keeps answering, so the pod stays
+#     Ready while reconciliation is wedged.
 #   - `route.openshift.io/routes` — OpenShift only; `kube.IsOpenshift` is false
 #     here, so the Route scheme is never even registered (cmd/main.go init()).
 #   - `endpointmonitors/finalizers` — IMC uses no finalizers. Deletion is driven