diff --git a/sources/keycloak-config/templates/keycloak-cluster.yaml b/sources/keycloak-config/templates/keycloak-cluster.yaml
index 60ac23e8..128e766d 100644
--- a/sources/keycloak-config/templates/keycloak-cluster.yaml
+++ b/sources/keycloak-config/templates/keycloak-cluster.yaml
@@ -75,8 +75,11 @@ spec:
         - GRANT CREATE ON SCHEMA public TO keycloak
       secret:
         name: keycloak-cnpg-user
+  {{- /* An explicit value wins; otherwise a single instance gets no PDB,
+         since one that never permits a disruption only blocks drains. */}}
+  enablePDB: {{ if kindIs "invalid" .Values.cnpg.enablePDB }}{{ gt (int .Values.cnpg.instances) 1 }}{{ else }}{{ .Values.cnpg.enablePDB }}{{ end }}
   imageName: ghcr.io/cloudnative-pg/postgresql:17
-  instances: 1
+  instances: {{ .Values.cnpg.instances }}
   nodeMaintenanceWindow:
     inProgress: false
     reusePVC: true
diff --git a/sources/keycloak-config/values.yaml b/sources/keycloak-config/values.yaml
index f97ac442..8f577f31 100644
--- a/sources/keycloak-config/values.yaml
+++ b/sources/keycloak-config/values.yaml
@@ -1 +1,11 @@
 domain: # to be filled by cluster-forge app
+
+cnpg:
+  instances: 1
+  # PodDisruptionBudget for the primary. Left unset, it follows instances:
+  # off for a single instance, on for two or more. A single-instance PDB
+  # protects nothing, because there is no second replica to keep serving,
+  # and it blocks `kubectl drain` on the node the pod happens to sit on,
+  # so node maintenance stalls until someone disables it by hand.
+  # Set true or false to override.
+  enablePDB: null
diff --git a/sources/keycloak-old/templates/keycloak-cnpg.yaml b/sources/keycloak-old/templates/keycloak-cnpg.yaml
index d1f4d11a..ee35097c 100644
--- a/sources/keycloak-old/templates/keycloak-cnpg.yaml
+++ b/sources/keycloak-old/templates/keycloak-cnpg.yaml
@@ -20,6 +20,9 @@ spec:
         - GRANT CREATE ON SCHEMA public TO {{ .Values.postgresql.username }}
       secret:
         name: {{ .Values.postgresql.userSecretName }}
+  {{- /* An explicit value wins; otherwise a single instance gets no PDB,
+         since one that never permits a disruption only blocks drains. */}}
+  enablePDB: {{ if kindIs "invalid" .Values.cnpg.enablePDB }}{{ gt (int .Values.cnpg.instances) 1 }}{{ else }}{{ .Values.cnpg.enablePDB }}{{ end }}
   imageName: ghcr.io/cloudnative-pg/postgresql:17
   instances: {{ .Values.cnpg.instances }}
   nodeMaintenanceWindow:
diff --git a/sources/keycloak-old/values.yaml b/sources/keycloak-old/values.yaml
index fbce3db5..1c839edf 100644
--- a/sources/keycloak-old/values.yaml
+++ b/sources/keycloak-old/values.yaml
@@ -7,6 +7,13 @@ hostname: ""
 cnpg:
   enabled: true
   instances: 1
+  # PodDisruptionBudget for the primary. Left unset, it follows instances:
+  # off for a single instance, on for two or more. A single-instance PDB
+  # protects nothing, because there is no second replica to keep serving,
+  # and it blocks `kubectl drain` on the node the pod happens to sit on,
+  # so node maintenance stalls until someone disables it by hand.
+  # Set true or false to override.
+  enablePDB: null
   storage:
     storageClassName: "default"