diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 0aa629a..64865ea 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -140,7 +140,7 @@ jobs:
             --set image.tag="${{ steps.sha.outputs.sha }}" \
             --atomic \
             --wait \
-            --timeout 10m
+            --timeout 20m
 
       - name: Rollout status (sanity)
         run: |
diff --git a/deploy/helm/tracebility/templates/api-deployment.yaml b/deploy/helm/tracebility/templates/api-deployment.yaml
index 9b19b3e..b339d94 100644
--- a/deploy/helm/tracebility/templates/api-deployment.yaml
+++ b/deploy/helm/tracebility/templates/api-deployment.yaml
@@ -8,6 +8,14 @@ metadata:
     app.kubernetes.io/component: api
 spec:
   replicas: {{ .Values.api.replicaCount }}
+  # Recreate so a single-replica rollout doesn't briefly need 2x the
+  # capacity of one pod. With Autopilot's just-in-time node scaling,
+  # RollingUpdate's default maxSurge=1 forces a node scale-up on every
+  # deploy; that takes ~5min and pushes the helm --wait past timeout.
+  # Brief outage during rollout is acceptable for the api service —
+  # the LB is fronted by web, not api directly.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       {{- include "tracebility.api.selectorLabels" . | nindent 6 }}
diff --git a/deploy/helm/tracebility/templates/ingest-worker-deployment.yaml b/deploy/helm/tracebility/templates/ingest-worker-deployment.yaml
index ffb4ffb..1a30553 100644
--- a/deploy/helm/tracebility/templates/ingest-worker-deployment.yaml
+++ b/deploy/helm/tracebility/templates/ingest-worker-deployment.yaml
@@ -8,6 +8,12 @@ metadata:
     app.kubernetes.io/component: ingest-worker
 spec:
   replicas: {{ .Values.ingestWorker.replicaCount }}
+  # Recreate so a single-replica rollout doesn't need 2x capacity. The
+  # worker is a Redis-stream consumer; redelivery on a brief outage is
+  # already in the failure model (XACK after successful insert), so
+  # killing the old pod before starting the new one is safe.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       {{- include "tracebility.ingestWorker.selectorLabels" . | nindent 6 }}