diff --git a/kubernetes/apps/authentik/cluster.yaml b/kubernetes/apps/authentik/cluster.yaml
index bc462409..f564e405 100644
--- a/kubernetes/apps/authentik/cluster.yaml
+++ b/kubernetes/apps/authentik/cluster.yaml
@@ -73,6 +73,10 @@ spec:
       # on an unclean shutdown is not an acceptable trade.
       checkpoint_timeout: "15min"
       max_wal_size: "2GB"
+      # authentik's subclass joins over empty tables get planner costs far above
+      # jit_above_cost; LLVM compilation then takes ~420 ms for a query that
+      # executes in 0.1 ms (every flow start, every RADIUS/LDAP login).
+      jit: "off"
       # zstd, not "on": the boolean spelling resolves to pglz (2016-era, weaker
       # and slower than the lz4/zstd this build also accepts). Compresses the
       # full-page images that dominate WAL volume after each checkpoint.
diff --git a/kubernetes/apps/authentik/helmrelease.yaml b/kubernetes/apps/authentik/helmrelease.yaml
index 18b71405..49c36276 100644
--- a/kubernetes/apps/authentik/helmrelease.yaml
+++ b/kubernetes/apps/authentik/helmrelease.yaml
@@ -69,6 +69,11 @@ spec:
             secretKeyRef:
               name: ak-pg-app
               key: password
+        # Default 0 opens a new Postgres connection per request.
+        - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+          value: "60"
+        - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+          value: "true"
         - name: AUTHENTIK_EMAIL__PASSWORD
           valueFrom:
             secretKeyRef: