diff --git a/apps/templates/cloudnativepg-helm.yaml b/apps/templates/cloudnativepg-helm.yaml
index a0ad217..8bf1d43 100644
--- a/apps/templates/cloudnativepg-helm.yaml
+++ b/apps/templates/cloudnativepg-helm.yaml
@@ -13,7 +13,12 @@ spec:
     targetRevision: 0.23.2
     helm:
       values: |
-        # Default values are fine
+        config:
+          data:
+            # Swap the instance manager inside running pods on operator
+            # upgrades instead of restarting them. Both clusters have a
+            # single instance, so a restart means downtime.
+            ENABLE_INSTANCE_MANAGER_INPLACE_UPDATES: "true"
   destination:
     server: https://kubernetes.default.svc
     namespace: cnpg-system
diff --git a/authentik/postgresql-cluster.yaml b/authentik/postgresql-cluster.yaml
index a791cc6..97090a0 100644
--- a/authentik/postgresql-cluster.yaml
+++ b/authentik/postgresql-cluster.yaml
@@ -4,6 +4,9 @@ metadata:
   name: authentik-postgres
 spec:
   instances: 1
+  # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't
+  # start an in-place major upgrade. CNPG filled this in at creation.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
   primaryUpdateStrategy: unsupervised
   bootstrap:
     initdb: