diff --git a/kubernetes/apps/woodpecker/server.yaml b/kubernetes/apps/woodpecker/server.yaml
index e3288650..aad51123 100644
--- a/kubernetes/apps/woodpecker/server.yaml
+++ b/kubernetes/apps/woodpecker/server.yaml
@@ -12,7 +12,10 @@ metadata:
     secret.reloader.stakater.com/reload: woodpecker-secret
 spec:
   serviceName: woodpecker
-  replicas: 1 # SQLite => single writer.
+  # Backed by the wp-pg CNPG Postgres cluster (was sqlite-on-PVC, #295/#324).
+  # Kept at 1 replica: woodpecker-server isn't clustered, and the DB is now
+  # external so this is just the single control-plane instance.
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: woodpecker
@@ -60,10 +63,24 @@ spec:
             # (retired LXCs tracked in #199) has been superseded.
             - name: WOODPECKER_PLUGINS_PRIVILEGED
               value: woodpeckerci/plugin-docker-buildx
+            # Postgres on the wp-pg CNPG cluster (creds from the CNPG-generated
+            # wp-pg-app secret). lib/pq keyword DSN — robust to any special
+            # chars in the generated password (unlike a URL DSN). WP_DB_* must
+            # precede the DATASOURCE for k8s $(VAR) interpolation to resolve.
+            - name: WP_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: wp-pg-app
+                  key: username
+            - name: WP_DB_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: wp-pg-app
+                  key: password
             - name: WOODPECKER_DATABASE_DRIVER
-              value: sqlite3
+              value: postgres
             - name: WOODPECKER_DATABASE_DATASOURCE
-              value: "/var/lib/woodpecker/woodpecker.sqlite?_journal=WAL&_busy_timeout=10000&_synchronous=NORMAL"
+              value: "host=wp-pg-rw.apps.svc.cluster.local port=5432 user=$(WP_DB_USER) password=$(WP_DB_PASS) dbname=woodpecker sslmode=require"
           # AGENT_SECRET + GITEA_CLIENT + GITEA_SECRET come from the SOPS secret.
           envFrom:
             - secretRef: