diff --git a/templates/ingressroute.yaml b/templates/ingressroute.yaml
index f4f2524..567ac78 100644
--- a/templates/ingressroute.yaml
+++ b/templates/ingressroute.yaml
@@ -58,6 +58,13 @@ spec:
   routes:
     - match: Host(`{{ .Values.instance.domain }}`)
       kind: Rule
+      # Cluster-level middleware (defined in cluster-platform-v3,
+      # same `tenants` namespace as this IngressRoute). Adds a
+      # bounded retry budget so transient Pod-not-ready windows
+      # during an Odoo restart don't surface as Traefik's default
+      # 404 to the customer. TLS-related fields below are unchanged.
+      middlewares:
+        - name: tenants-default-retry
       services:
         - name: {{ include "instance.fullname" . }}-odoo
           port: 8069
diff --git a/templates/odoo-deployment.yaml b/templates/odoo-deployment.yaml
index bbcd065..d653d18 100644
--- a/templates/odoo-deployment.yaml
+++ b/templates/odoo-deployment.yaml
@@ -250,13 +250,19 @@ spec:
           # /web/login is the most stable health endpoint across Odoo
           # 16/17/18/19 — /web/health is 17+. Use login HTTP 200 as
           # readiness signal.
+          #
+          # 5s period so K8s catches an Odoo restart (addon install
+          # via the Apps menu can trigger one) within a single probe
+          # cycle and pulls the Pod from Endpoints — paired with the
+          # Traefik retry middleware that swallows the brief gap.
           readinessProbe:
             httpGet:
               path: /web/login
               port: 8069
             initialDelaySeconds: 30
-            periodSeconds: 10
+            periodSeconds: 5
             timeoutSeconds: 5
+            failureThreshold: 2
           livenessProbe:
             tcpSocket:
               port: 8069