diff --git a/apps/base/arrstack/postgres/cnpg_backup.yaml b/apps/base/arrstack/postgres/cnpg_backup.yaml
index acabcd3..fce9a69 100644
--- a/apps/base/arrstack/postgres/cnpg_backup.yaml
+++ b/apps/base/arrstack/postgres/cnpg_backup.yaml
@@ -7,9 +7,6 @@ kind: ObjectStoreUser
 metadata:
   name: cnpg-arrstack-backup
   namespace: arrstack
-  annotations:
-    # S3 creds Secret must exist before the Cluster (wave -2) reconciles its backup.
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   displayName: "CNPG backup owner (arrstack)"
   uid: cnpg-arrstack-backup
@@ -22,8 +19,6 @@ kind: Bucket
 metadata:
   name: cnpg-arrstack
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   placementTarget: ec
   bucketName: cnpg-arrstack
diff --git a/apps/base/arrstack/postgres/cnpg_cluster.yaml b/apps/base/arrstack/postgres/cnpg_cluster.yaml
index fc2813f..a27ded6 100644
--- a/apps/base/arrstack/postgres/cnpg_cluster.yaml
+++ b/apps/base/arrstack/postgres/cnpg_cluster.yaml
@@ -11,11 +11,6 @@ kind: Cluster
 metadata:
   name: arrstack-postgres
   namespace: arrstack
-  annotations:
-    # Wave 1: the per-app <app>-db Secrets (wave 0) must exist first — CNPG reads
-    # them as the managed roles' passwordSecret. ArgoCD gates dependents on the
-    # Cluster's health status.
-    argocd.argoproj.io/sync-wave: "-2"
 spec:
   inheritedMetadata:
     annotations:
diff --git a/apps/base/arrstack/postgres/database-prowlarr.yaml b/apps/base/arrstack/postgres/database-prowlarr.yaml
index 56febfd..6d5c0f8 100644
--- a/apps/base/arrstack/postgres/database-prowlarr.yaml
+++ b/apps/base/arrstack/postgres/database-prowlarr.yaml
@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: prowlarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres
diff --git a/apps/base/arrstack/postgres/database-radarr.yaml b/apps/base/arrstack/postgres/database-radarr.yaml
index fa205c1..e30da8f 100644
--- a/apps/base/arrstack/postgres/database-radarr.yaml
+++ b/apps/base/arrstack/postgres/database-radarr.yaml
@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: radarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres
diff --git a/apps/base/arrstack/postgres/database-sonarr.yaml b/apps/base/arrstack/postgres/database-sonarr.yaml
index 91e3d62..aa9f521 100644
--- a/apps/base/arrstack/postgres/database-sonarr.yaml
+++ b/apps/base/arrstack/postgres/database-sonarr.yaml
@@ -7,8 +7,6 @@ kind: Database
 metadata:
   name: sonarr-main
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-1"
 spec:
   cluster:
     name: arrstack-postgres
diff --git a/apps/base/arrstack/postgres/vaultstaticsecret.yaml b/apps/base/arrstack/postgres/vaultstaticsecret.yaml
index 1965408..101a6ad 100644
--- a/apps/base/arrstack/postgres/vaultstaticsecret.yaml
+++ b/apps/base/arrstack/postgres/vaultstaticsecret.yaml
@@ -13,8 +13,6 @@ kind: VaultStaticSecret
 metadata:
   name: sonarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -32,8 +30,6 @@ kind: VaultStaticSecret
 metadata:
   name: radarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
@@ -51,8 +47,6 @@ kind: VaultStaticSecret
 metadata:
   name: prowlarr-db
   namespace: arrstack
-  annotations:
-    argocd.argoproj.io/sync-wave: "-3"
 spec:
   destination:
     create: true
diff --git a/apps/base/arrstack/prowlarr/deployment.yaml b/apps/base/arrstack/prowlarr/deployment.yaml
index 597786a..6ee4d6a 100644
--- a/apps/base/arrstack/prowlarr/deployment.yaml
+++ b/apps/base/arrstack/prowlarr/deployment.yaml
@@ -28,6 +28,44 @@ spec:
         runAsGroup: 1000
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # libpq reads PG* from env, so the password never lands in argv.
+        - name: wait-for-db
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until psql -tAc 'select 1' >/dev/null 2>&1; do
+                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
+              done
+              echo "database ready"
+          env:
+            - name: PGHOST
+              value: arrstack-postgres-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: prowlarr-main
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: prowlarr-db
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: prowlarr-db
+                  key: password
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
       containers:
         - name: prowlarr
           image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/prowlarr:v2.6.2-unkin2
diff --git a/apps/base/arrstack/radarr/deployment.yaml b/apps/base/arrstack/radarr/deployment.yaml
index 50e5e7f..f52555f 100644
--- a/apps/base/arrstack/radarr/deployment.yaml
+++ b/apps/base/arrstack/radarr/deployment.yaml
@@ -28,6 +28,44 @@ spec:
         runAsGroup: 1000
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # libpq reads PG* from env, so the password never lands in argv.
+        - name: wait-for-db
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until psql -tAc 'select 1' >/dev/null 2>&1; do
+                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
+              done
+              echo "database ready"
+          env:
+            - name: PGHOST
+              value: arrstack-postgres-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: radarr-main
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: radarr-db
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: radarr-db
+                  key: password
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
       containers:
         - name: radarr
           image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/radarr:v6.4.2-unkin2
diff --git a/apps/base/arrstack/sonarr/deployment.yaml b/apps/base/arrstack/sonarr/deployment.yaml
index 1f9084b..9330c47 100644
--- a/apps/base/arrstack/sonarr/deployment.yaml
+++ b/apps/base/arrstack/sonarr/deployment.yaml
@@ -28,6 +28,44 @@ spec:
         runAsGroup: 1000
         fsGroup: 1000
         fsGroupChangePolicy: OnRootMismatch
+      initContainers:
+        # Gate the app on its own Postgres database+role being reachable, instead
+        # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
+        # libpq reads PG* from env, so the password never lands in argv.
+        - name: wait-for-db
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
+          command:
+            - sh
+            - -c
+            - |
+              until psql -tAc 'select 1' >/dev/null 2>&1; do
+                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
+              done
+              echo "database ready"
+          env:
+            - name: PGHOST
+              value: arrstack-postgres-rw.arrstack.svc.cluster.local
+            - name: PGPORT
+              value: "5432"
+            - name: PGDATABASE
+              value: sonarr-main
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-db
+                  key: username
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-db
+                  key: password
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
       containers:
         - name: sonarr
           image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/sonarr:v5.0.0-unkin2