diff --git a/deploy/argocd/app.yaml b/deploy/argocd/app.yaml
index 9be05b4..dbae640 100644
--- a/deploy/argocd/app.yaml
+++ b/deploy/argocd/app.yaml
@@ -67,3 +67,23 @@ spec:
       kind: Job
       jsonPointers:
         - /spec/template/metadata/labels
+    # This cluster runs a Kyverno ClusterPolicy, `force-best-effort-cpu`, whose rule
+    # set-cpu-request-to-zero rewrites every container's CPU request to "0" at admission.
+    # It is deliberate and predates this app by well over a year: the nodes are
+    # oversubscribed, and making pods BestEffort on CPU is how everything gets scheduled.
+    #
+    # The chart asks for 50m and the cluster writes 0, so without this the Deployments sit
+    # permanently OutOfSync while being perfectly Healthy — the failure mode where a
+    # dashboard is always yellow, everyone learns to ignore it, and it stops meaning
+    # anything the day it goes yellow for a real reason.
+    #
+    # The chart deliberately keeps its real request rather than capitulating to 0. What the
+    # chart asks for is the honest intent; what the cluster does with it is the cluster's
+    # business, and a reader of the repo should see the former.
+    #
+    # jqPathExpressions, not jsonPointers: a pointer would have to name a container index,
+    # and this has to hold for every container in every one of the three Deployments.
+    - group: apps
+      kind: Deployment
+      jqPathExpressions:
+        - .spec.template.spec.containers[].resources.requests.cpu