diff --git a/apps/base/authentik/cnpg_cluster.yaml b/apps/base/authentik/cnpg_cluster.yaml
index a7490f7..c1dd6f9 100644
--- a/apps/base/authentik/cnpg_cluster.yaml
+++ b/apps/base/authentik/cnpg_cluster.yaml
@@ -66,6 +66,10 @@ spec:
       dynamic_shared_memory_type: posix
       effective_cache_size: 256MB
       full_page_writes: "on"
+      # Replicas report their oldest xmin to the primary, so multi-second reads on
+      # a hot standby stop exhausting max_standby_streaming_delay and being
+      # cancelled. Retained-dead-tuple cost is negligible on a ~155MB database.
+      hot_standby_feedback: "on"
       log_destination: csvlog
       log_directory: /controller/log
       log_filename: postgres