diff --git a/CLAUDE.md b/CLAUDE.md
index 03308a4..8069a07 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,8 +10,9 @@ Kubernetes. It is a **generic, reusable package** consumed by multiple projects.
 
 Phase 1 (done) is a faithful 1:1 port: the deploy **order** and all **end states** of the
 legacy pipeline are preserved. Phase 2 (planned) is manifest modernization — until then,
-manifests intentionally keep their legacy shape (including oddities like the `sleep 30` in
-the first-deploy migration command). Do not "improve" manifest content without being asked.
+manifests intentionally keep their legacy shape; the few intentional exceptions are
+registered in `docs/migrating-from-shopsys-deployment.md`. Do not "improve" manifest
+content without being asked.
 
 **Helm 4 only** — no Helm 3 backward compatibility (e.g. `helm plugin install` uses
 `--verify=false`, which Helm 3 does not know). Keep CI's `HELM_VERSION` in sync with the
diff --git a/charts/shopsys-app/templates/hooks/job-migrate-application.yaml b/charts/shopsys-app/templates/hooks/job-migrate-application.yaml
index 08db7d3..ae88710 100644
--- a/charts/shopsys-app/templates/hooks/job-migrate-application.yaml
+++ b/charts/shopsys-app/templates/hooks/job-migrate-application.yaml
@@ -9,8 +9,8 @@ it at the start of the next deploy (legacy "Delete previous migration pod" step)
 
 The command variant is selected by deploy.firstDeploy.*:
 - continuous deploy: check migrations + enable maintenance + run db-dependent build phase
-- first deploy: full first deploy of the cluster (the sleep 30 is kept from the legacy
- package to let infrastructure services settle)
+- first deploy: full first deploy of the cluster (the legacy sleep 30 was dropped - the
+ shopsys-infra release is waited on before this hook runs, see the deviations doc)
 - first deploy with demo data: first deploy + demo data import
 */}}
 {{- if .Values.deploy.migration.enabled }}
@@ -18,9 +18,9 @@ The command variant is selected by deploy.firstDeploy.*:
 {{- $command := printf "cd /var/www/html && ./phing %s" $targets.continuous }}
 {{- if .Values.deploy.firstDeploy.enabled }}
 {{- if .Values.deploy.firstDeploy.loadDemoData }}
-{{- $command = printf "cd /var/www/html && sleep 30 && ./phing %s" $targets.firstDeployWithDemoData }}
+{{- $command = printf "cd /var/www/html && ./phing %s" $targets.firstDeployWithDemoData }}
 {{- else }}
-{{- $command = printf "cd /var/www/html && sleep 30 && ./phing %s" $targets.firstDeploy }}
+{{- $command = printf "cd /var/www/html && ./phing %s" $targets.firstDeploy }}
 {{- end }}
 {{- end }}
 apiVersion: batch/v1
@@ -35,6 +35,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: {{ .Values.deploy.migration.activeDeadlineSeconds }}
   template:
     spec:
       volumes:
diff --git a/charts/shopsys-app/templates/hooks/job-post-deploy.yaml b/charts/shopsys-app/templates/hooks/job-post-deploy.yaml
index bfa5c40..55c4505 100644
--- a/charts/shopsys-app/templates/hooks/job-post-deploy.yaml
+++ b/charts/shopsys-app/templates/hooks/job-post-deploy.yaml
@@ -17,6 +17,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: {{ .Values.deploy.postDeploy.activeDeadlineSeconds }}
   template:
     spec:
       volumes:
diff --git a/charts/shopsys-app/tests/hooks_test.yaml b/charts/shopsys-app/tests/hooks_test.yaml
index 6ce6906..3fae5ae 100644
--- a/charts/shopsys-app/tests/hooks_test.yaml
+++ b/charts/shopsys-app/tests/hooks_test.yaml
@@ -25,6 +25,9 @@ tests:
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
           pattern: 'db-migrations-count-with-maintenance build-deploy-part-2-db-dependent'
+      - equal:
+          path: spec.activeDeadlineSeconds
+          value: 1800
 
   - it: switches the command on first deploy
     template: templates/hooks/job-migrate-application.yaml
@@ -35,7 +38,7 @@ tests:
     asserts:
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
-          pattern: 'sleep 30 && \./phing cluster-first-deploy$'
+          pattern: 'cd /var/www/html && \./phing cluster-first-deploy$'
 
   - it: loads demo data on first deploy when requested
     template: templates/hooks/job-migrate-application.yaml
@@ -77,6 +80,9 @@ tests:
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
           pattern: 'set -e'
+      - equal:
+          path: spec.activeDeadlineSeconds
+          value: 1800
       - matchRegex:
           path: spec.template.spec.containers[0].command[2]
           pattern: './phing maintenance-off\n'
diff --git a/charts/shopsys-app/values.schema.json b/charts/shopsys-app/values.schema.json
index 51d2a9c..66e0d78 100644
--- a/charts/shopsys-app/values.schema.json
+++ b/charts/shopsys-app/values.schema.json
@@ -158,6 +158,20 @@
             "enabled": { "type": "boolean" },
             "loadDemoData": { "type": "boolean" }
           }
+        },
+        "migration": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "activeDeadlineSeconds": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "postDeploy": {
+          "type": "object",
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "activeDeadlineSeconds": { "type": "integer", "minimum": 1 }
+          }
         }
       }
     },
diff --git a/charts/shopsys-app/values.yaml b/charts/shopsys-app/values.yaml
index 583efa2..71c801d 100644
--- a/charts/shopsys-app/values.yaml
+++ b/charts/shopsys-app/values.yaml
@@ -353,9 +353,18 @@ deploy:
       continuous: "-verbose db-migrations-count-with-maintenance build-deploy-part-2-db-dependent"
       firstDeploy: "cluster-first-deploy"
       firstDeployWithDemoData: "cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"
+    # Hard bound for the migration Job (seconds); must exceed the longest migration -
+    # first deploys with demo data (elasticsearch-export) may need a much higher value.
+    # Keep it below the helmfile timeout (DEPLOY_TIMEOUT, default 2700) so a stuck
+    # migration fails as a DeadlineExceeded Job instead of a Helm client timeout.
+    activeDeadlineSeconds: 1800
     resources: {}
   postDeploy:
     enabled: true
+    # Hard bound for the post-deploy Job (seconds). Together with the migration bound this
+    # can exceed DEPLOY_TIMEOUT (2700 s) - acceptable, both hitting their ceiling in one
+    # deploy is not a normal scenario.
+    activeDeadlineSeconds: 1800
     resources: {}
   hooks:
     # kubectlImage is the image used by the cron-suspend hook Job; pinned tag on purpose
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 9b94c07..e216fe7 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -87,7 +87,11 @@ print_job_logs() {
     local job="$1" title="$2"
     if kubectl -n "${NAMESPACE}" get "job/${job}" > /dev/null 2>&1; then
         section_start "${job//-/_}_logs" "${title}"
-        kubectl logs "job/${job}" --namespace="${NAMESPACE}" || true
+        if ! kubectl logs "job/${job}" --namespace="${NAMESPACE}" 2> /dev/null; then
+            # A deadline-killed Job (activeDeadlineSeconds) has its pod deleted, so no
+            # logs exist - fall back to the Job description (conditions + events)
+            kubectl describe "job/${job}" --namespace="${NAMESPACE}" || true
+        fi
         section_end "${job//-/_}_logs"
     fi
 }
diff --git a/docs/deploy-flow.md b/docs/deploy-flow.md
index 7df31f5..3156cc6 100644
--- a/docs/deploy-flow.md
+++ b/docs/deploy-flow.md
@@ -27,7 +27,7 @@ For the legacy behavior itself see [original-deployment.md](original-deployment.
 │           ├─ hook pre-install,pre-upgrade (w10): migrate-application Job
 │           │     continuous:  phing db-migrations-count-with-maintenance
 │           │                  build-deploy-part-2-db-dependent
-│           │     first:       sleep 30 && phing cluster-first-deploy [+ demo targets]
+│           │     first:       phing cluster-first-deploy [+ demo targets]
 │           │     └─ FAILS → whole apply aborts, old release stays
 │           ├─ manifests apply + rollout wait (webserver, storefront, cron on the
 │           │     new image – the `date` label forces a new pod, consumers, ingresses,
diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md
index c2e2d1f..1a5e6d9 100644
--- a/docs/migrating-from-shopsys-deployment.md
+++ b/docs/migrating-from-shopsys-deployment.md
@@ -84,8 +84,18 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port.
    `domains-urls-hook` copy because pre-install hooks run before regular resources exist.
 8. **Namespace** is created by the wrapper/helmfile, not applied as a manifest. It is named
    `<project.name>-<environment>` (replaces the "PROJECT_NAME must contain a dash" rule).
-9. **`sleep 30`** in the first-deploy migration command is kept verbatim for parity even
-   though the infra release already guarantees readiness.
+9. **The legacy `sleep 30`** in the first-deploy migration command is removed — the
+   shopsys-infra release is installed with `wait: true` before the migration hook runs
+   (Redis readiness is probe-backed; RabbitMQ has no default readinessProbe, so the wait
+   guarantees a Running broker container, not yet an accepting broker). The migration and
+   post-deploy Jobs are additionally bounded by `deploy.migration.activeDeadlineSeconds`
+   (default 1800 s — first deploys with demo data may need much more, see
+   [values.md](values.md)) and `deploy.postDeploy.activeDeadlineSeconds` (default 1800 s;
+   the two bounds together can exceed `DEPLOY_TIMEOUT` — acceptable, both hitting their
+   ceiling in one deploy is not a normal scenario).
+   When a deadline fires, the Job controller deletes the running pod — the Job fails as
+   `DeadlineExceeded` (the wrapper's recovery path still triggers), but the pod logs are
+   gone; the wrapper then falls back to `kubectl describe job` output.
 10. **DISPLAY_FINAL_CONFIGURATION** prints one `helmfile template` output instead of two
     kustomize sections.
 11. **`orchestration/kubernetes/` file overrides and the composer `merge` step are gone** —
diff --git a/docs/values.md b/docs/values.md
index fd69463..ddd0f12 100644
--- a/docs/values.md
+++ b/docs/values.md
@@ -84,8 +84,9 @@ rabbitmq:                    # infra component + auth/persistence/management
 deploy:
   timestamp: ""              # injected by the wrapper (forces a new cron pod)
   firstDeploy: { enabled: false, loadDemoData: false }
-  migration: { enabled, targets: {continuous, firstDeploy, firstDeployWithDemoData}, resources }
-  postDeploy: { enabled, resources }
+  migration: { enabled, targets: {continuous, firstDeploy, firstDeployWithDemoData},
+               resources, activeDeadlineSeconds }   # hard Job bound, default 1800 s
+  postDeploy: { enabled, resources, activeDeadlineSeconds }   # hard Job bound, default 1800 s
   hooks: { kubectlImage, serviceAccountName }
 
 extraManifests: []           # raw manifests (rendered through tpl) — escape hatch
@@ -100,6 +101,13 @@ entries take precedence over `envFrom` in Kubernetes — never define the same k
 Lists (e.g. `security.whitelistIps`, `domains`) **replace** the base value when overridden by
 an environment file — they are not merged. Maps merge deeply.
 
+`deploy.migration.activeDeadlineSeconds` must exceed the longest migration variant of the
+project — first deploys with demo data (`elasticsearch-export` on real data volumes) may
+need a much higher value than the 1800 s default. Keep it below the helmfile timeout
+(`DEPLOY_TIMEOUT`, default 2700 s, raise both together) so a stuck migration fails as a
+`DeadlineExceeded` Job — which the wrapper's recovery path handles — instead of the Helm
+client timing out.
+
 ## Legacy env var → values mapping
 
 | Legacy env var | New location |
diff --git a/tests/golden/scenarios/basic-production/expected/continuous.yaml b/tests/golden/scenarios/basic-production/expected/continuous.yaml
index fda309d..753e900 100644
--- a/tests/golden/scenarios/basic-production/expected/continuous.yaml
+++ b/tests/golden/scenarios/basic-production/expected/continuous.yaml
@@ -1742,6 +1742,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1810,6 +1813,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml
index 4fa723f..5b12854 100644
--- a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml
+++ b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml
@@ -1742,6 +1742,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1751,7 +1754,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1810,6 +1813,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml
index 6e59144..5db65ff 100644
--- a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml
+++ b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml
@@ -1742,6 +1742,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1751,7 +1754,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1810,6 +1813,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml
index d7a06fd..0caab72 100644
--- a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml
+++ b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml
@@ -1519,6 +1519,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1587,6 +1590,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml
index f24e535..8419d4b 100644
--- a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml
+++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml
@@ -1519,6 +1519,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1528,7 +1531,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1587,6 +1590,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml
index c742794..7ec9cd1 100644
--- a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml
+++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml
@@ -1519,6 +1519,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1528,7 +1531,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1587,6 +1590,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml
index 49a4eb4..fa3dc8b 100644
--- a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml
+++ b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml
@@ -1573,6 +1573,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1641,6 +1644,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml
index 2fe4f09..8aaac29 100644
--- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml
+++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml
@@ -1573,6 +1573,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1582,7 +1585,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1641,6 +1644,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml
index ebcc1ea..eb1164d 100644
--- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml
+++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml
@@ -1573,6 +1573,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1582,7 +1585,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1641,6 +1644,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/escaping-env/expected/continuous.yaml b/tests/golden/scenarios/escaping-env/expected/continuous.yaml
index f7d5168..6d00e93 100644
--- a/tests/golden/scenarios/escaping-env/expected/continuous.yaml
+++ b/tests/golden/scenarios/escaping-env/expected/continuous.yaml
@@ -1769,6 +1769,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1839,6 +1842,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml
index 10aa7d7..0fc45a9 100644
--- a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml
+++ b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml
@@ -1769,6 +1769,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1778,7 +1781,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1839,6 +1842,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml
index 050be36..777e939 100644
--- a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml
+++ b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml
@@ -1769,6 +1769,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1778,7 +1781,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1839,6 +1842,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml
index e15485e..0ad3466 100644
--- a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml
+++ b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml
@@ -1874,6 +1874,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1942,6 +1945,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml
index ba649cd..c264a41 100644
--- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml
+++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml
@@ -1874,6 +1874,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1883,7 +1886,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy db-fixtures-demo plugin-demo-data-load friendly-urls-generate domains-urls-replace elasticsearch-export"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1942,6 +1945,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml
index 370b55e..cca513b 100644
--- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml
+++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml
@@ -1874,6 +1874,9 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  # Bound the migration - a stuck Job otherwise blocks the deploy until the global
+  # helmfile timeout and stays running in the cluster
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes:
@@ -1883,7 +1886,7 @@ spec:
       containers:
         - name: migrate-application
           image: "v1.0.0"
-          command: ["sh", "-c", "cd /var/www/html && sleep 30 && ./phing cluster-first-deploy"]
+          command: ["sh", "-c", "cd /var/www/html && ./phing cluster-first-deploy"]
           envFrom:
             - secretRef:
                 name: app-secret-env-hook
@@ -1942,6 +1945,7 @@ metadata:
     helm.sh/hook-delete-policy: before-hook-creation
 spec:
   backoffLimit: 0
+  activeDeadlineSeconds: 1800
   template:
     spec:
       volumes: