diff --git a/kubernetes/seed/authentik/cluster.yaml b/kubernetes/seed/authentik/cluster.yaml
index d957a840..fd0bc143 100644
--- a/kubernetes/seed/authentik/cluster.yaml
+++ b/kubernetes/seed/authentik/cluster.yaml
@@ -5,6 +5,13 @@ metadata:
   namespace: authentik
 spec:
   instances: 2
+  # Cap graceful-drain on demotion: on failover/switchover the old primary is
+  # removed from the -rw service immediately, but the new primary is only
+  # promoted once the old one is down. The default smart-shutdown waits 180s
+  # for client connections to drain (Authentik holds persistent conns), leaving
+  # -rw backendless that whole time. Capping at 10s bounds failover downtime to
+  # ~10-15s (fast shutdown + promotion).
+  smartShutdownTimeout: 10
   imageName: ghcr.io/cloudnative-pg/postgresql:16
   enableSuperuserAccess: true
   storage: