diff --git a/apps/base/arrstack/prowlarr/deployment.yaml b/apps/base/arrstack/prowlarr/deployment.yaml
index 6ee4d6a..fc976cb 100644
--- a/apps/base/arrstack/prowlarr/deployment.yaml
+++ b/apps/base/arrstack/prowlarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT
diff --git a/apps/base/arrstack/radarr/deployment.yaml b/apps/base/arrstack/radarr/deployment.yaml
index f52555f..a19e944 100644
--- a/apps/base/arrstack/radarr/deployment.yaml
+++ b/apps/base/arrstack/radarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT
diff --git a/apps/base/arrstack/sonarr/deployment.yaml b/apps/base/arrstack/sonarr/deployment.yaml
index 9330c47..526b533 100644
--- a/apps/base/arrstack/sonarr/deployment.yaml
+++ b/apps/base/arrstack/sonarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT