diff --git a/kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml b/kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml
index f6fa0836..5b356471 100644
--- a/kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml
+++ b/kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml
@@ -112,4 +112,13 @@ spec:
     txtOwnerId: k8s-homelab
     policy: sync
     extraArgs:
-      - --webhook-provider-read-timeout=30s
+      # The UDM's /proxy/network/v2/.../static-dns/ endpoint occasionally takes
+      # just over 30s to answer (128 records). external-dns treats ANY RunOnce
+      # error as fatal (log.Fatalf -> exit 1), so a single slow read crashes the
+      # container and the pod enters CrashLoopBackOff — even though the webhook
+      # sidecar completed the fetch successfully a moment later and only failed
+      # to write the response ("broken pipe", client already gone). 60s gives
+      # ~2x headroom over the observed worst case. Raising this cannot stall the
+      # reconcile loop: external-dns runs RunOnce sequentially, so a slow read
+      # just delays the next cycle past the 1m interval.
+      - --webhook-provider-read-timeout=60s