diff --git a/deploy.sh b/deploy.sh
index 8de13a8..211214e 100644
--- a/deploy.sh
+++ b/deploy.sh
@@ -25,16 +25,16 @@ command_exists kubectl || err "kubectl not found — install via https://kuberne
 log "helm $(helm version --short)"
 log "kubectl $(kubectl version --client --short 2>/dev/null || kubectl version -o json 2>/dev/null | grep gitVersion)"
 
-# ── 1. Ensure namespace with Helm ownership ──────────────────────────
-log "Ensuring namespace $NAMESPACE exists with Helm ownership..."
+# ── 1. Ensure namespace (not managed by Helm — preserved on uninstall) ──
+log "Ensuring namespace $NAMESPACE exists..."
 kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
-kubectl label namespace "$NAMESPACE" app.kubernetes.io/managed-by=Helm --overwrite
-kubectl label namespace "$NAMESPACE" meta.helm.sh/release-name="$RELEASE" --overwrite
-kubectl label namespace "$NAMESPACE" meta.helm.sh/release-namespace="$NAMESPACE" --overwrite
-kubectl annotate namespace "$NAMESPACE" meta.helm.sh/release-name="$RELEASE" --overwrite
-kubectl annotate namespace "$NAMESPACE" meta.helm.sh/release-namespace="$NAMESPACE" --overwrite
 
 # ── 2. Ensure prerequisites ─────────────────────────────────────────
+# Namespace must exist (not managed by Helm)
+if ! kubectl get namespace "$NAMESPACE" &>/dev/null; then
+    err "Namespace '$NAMESPACE' not found — create it first: kubectl create namespace $NAMESPACE"
+fi
+
 # ConfigMap (must exist before Helm install)
 if ! kubectl get configmap "$CONFIG_MAP" -n "$NAMESPACE" &>/dev/null; then
     err "ConfigMap '$CONFIG_MAP' not found in namespace '$NAMESPACE' — create it first"
diff --git a/deploy/templates/gingress/rbac.yaml b/deploy/templates/gingress/rbac.yaml
index 2e55388..b838d8c 100644
--- a/deploy/templates/gingress/rbac.yaml
+++ b/deploy/templates/gingress/rbac.yaml
@@ -1,9 +1,4 @@
 apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ .Values.gingress.namespace | default "gingress-system" }}
----
-apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: gingress-controller
diff --git a/deploy/values.yaml b/deploy/values.yaml
index 9888173..43f69b6 100644
--- a/deploy/values.yaml
+++ b/deploy/values.yaml
@@ -161,7 +161,7 @@ ingress:
   enabled: true
   className: "gingress"
   annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    cert-manager.io/cluster-issuer: "cloudflare-acme-cluster-issuer"
     gingress.io/git-backend: "deploy-gitserver:8021"
   hosts:
     - host: gitdata.ai
diff --git a/libs/config/database.rs b/libs/config/database.rs
index b63801e..a33b515 100644
--- a/libs/config/database.rs
+++ b/libs/config/database.rs
@@ -23,19 +23,19 @@ impl AppConfig {
         if let Some(idle_timeout) = self.env.get("APP_DATABASE_IDLE_TIMEOUT") {
             return Ok(idle_timeout.parse::<u64>()?);
         }
-        Ok(60000) // milliseconds
+        Ok(600) // seconds
     }
     pub fn database_max_lifetime(&self) -> anyhow::Result<u64> {
         if let Some(max_lifetime) = self.env.get("APP_DATABASE_MAX_LIFETIME") {
             return Ok(max_lifetime.parse::<u64>()?);
         }
-        Ok(300000) // milliseconds
+        Ok(3600) // seconds
     }
     pub fn database_connection_timeout(&self) -> anyhow::Result<u64> {
         if let Some(connection_timeout) = self.env.get("APP_DATABASE_CONNECTION_TIMEOUT") {
             return Ok(connection_timeout.parse::<u64>()?);
         }
-        Ok(5000) // milliseconds
+        Ok(8) // seconds
     }
     pub fn database_schema_search_path(&self) -> anyhow::Result<String> {
         if let Some(schema_search_path) = self.env.get("APP_DATABASE_SCHEMA_SEARCH_PATH") {
diff --git a/libs/db/database.rs b/libs/db/database.rs
index fc0a379..5c36e91 100644
--- a/libs/db/database.rs
+++ b/libs/db/database.rs
@@ -26,9 +26,9 @@ impl AppDatabase {
         let conn_cfg = sea_orm::ConnectOptions::new(db_url)
             .max_connections(max_connections)
             .min_connections(min_connections)
-            .idle_timeout(Duration::from_millis(idle_timeout))
-            .max_lifetime(Duration::from_millis(max_lifetime))
-            .connect_timeout(Duration::from_millis(connection_timeout))
+            .idle_timeout(Duration::from_secs(idle_timeout))
+            .max_lifetime(Duration::from_secs(max_lifetime))
+            .connect_timeout(Duration::from_secs(connection_timeout))
             .set_schema_search_path(schema_search_path)
             .sqlx_logging(false)
             .to_owned();