diff --git a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
index 47c22f76..277b6df8 100644
--- a/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
+++ b/packages/apps/kubernetes/templates/cluster-autoscaler/deployment.yaml
@@ -31,7 +31,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 99249c1a..1747df4e 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -1,6 +1,6 @@
 {{- $etcd := .Values._namespace.etcd }}
 {{- if not $etcd }}
-{{- fail "Kubernetes tenant requires a parent tenant with etcd enabled: set .Values.etcd=true on tenant-root (or any ancestor tenant), wait for the etcd HelmRelease to reconcile (DataStore CR appears in the tenant namespace), then retry." }}
+{{- fail "Kubernetes tenant requires a parent Tenant application with etcd: true so the etcd module deploys a DataStore CR in the tenant namespace. Set spec.etcd: true on the root Tenant (or any ancestor Tenant), wait for the etcd HelmRelease to reconcile and the DataStore CR to appear, then retry." }}
 {{- end }}
 {{- $ingress := .Values._namespace.ingress }}
 {{- $host := .Values._namespace.host }}
diff --git a/packages/apps/kubernetes/templates/csi/deploy.yaml b/packages/apps/kubernetes/templates/csi/deploy.yaml
index 2979c75c..ff170cb8 100644
--- a/packages/apps/kubernetes/templates/csi/deploy.yaml
+++ b/packages/apps/kubernetes/templates/csi/deploy.yaml
@@ -32,7 +32,12 @@ spec:
           - -c
           - |
             set -eu
+            deadline=$(( $(date +%s) + 1200 ))
             until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+              if [ "$(date +%s)" -ge "$deadline" ]; then
+                echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+                exit 1
+              fi
               echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
               sleep 5
             done
diff --git a/packages/apps/kubernetes/templates/kccm/manager.yaml b/packages/apps/kubernetes/templates/kccm/manager.yaml
index 5c7f15a4..67321647 100644
--- a/packages/apps/kubernetes/templates/kccm/manager.yaml
+++ b/packages/apps/kubernetes/templates/kccm/manager.yaml
@@ -30,7 +30,12 @@ spec:
         - -c
         - |
           set -eu
+          deadline=$(( $(date +%s) + 1200 ))
           until [ -s /etc/kubernetes/kubeconfig/super-admin.svc ]; do
+            if [ "$(date +%s)" -ge "$deadline" ]; then
+              echo "admin kubeconfig was not provisioned within 20m; exiting so the pod goes CrashLoopBackOff and surfaces in dashboards" >&2
+              exit 1
+            fi
             echo "waiting for admin kubeconfig to be provisioned by Kamaji..."
             sleep 5
           done
diff --git a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
index 3b2b1d72..2a43e13f 100644
--- a/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
+++ b/packages/apps/kubernetes/tests/admin_kubeconfig_wait_test.yaml
@@ -116,4 +116,4 @@ tests:
         host: ""
     asserts:
       - failedTemplate:
-          errorPattern: "requires a parent tenant with etcd enabled"
+          errorPattern: "requires a parent Tenant application with etcd: true"