diff --git a/apps/wave-0/nextcloud-db.yaml b/apps/wave-0/nextcloud-db.yaml
index 8bfe33a..75a79fc 100644
--- a/apps/wave-0/nextcloud-db.yaml
+++ b/apps/wave-0/nextcloud-db.yaml
@@ -381,11 +381,20 @@ data:
 
     -- Fail the Job if the privilege is somehow still absent, so a broken
     -- reconciler surfaces as a failed Job rather than as a quiet blind spot.
-    DO $$
-    BEGIN
-      IF NOT has_database_privilege('cnpg_metrics_exporter', 'nextcloud', 'CONNECT') THEN
-        RAISE EXCEPTION 'cnpg_metrics_exporter still lacks CONNECT on database nextcloud';
-      END IF;
-      RAISE NOTICE 'converged: cnpg_metrics_exporter has CONNECT on database nextcloud';
-    END
-    $$;
+    -- NO PL/pgSQL, AND NOT ONE DOLLAR SIGN IN THIS FILE — DELIBERATE, including in these
+    -- comments. This assertion began life as a dollar-quoted DO block, which cannot survive
+    -- being shipped this way: the ConfigMap is rendered through Flux's postBuild
+    -- substitution, and envsubst collapses a doubled dollar into a single one. The block
+    -- reached Postgres with its opening quote halved and every Flux-reconciled run died
+    -- with a syntax error pointing at that character.
+    -- It PASSED when hand-applied with kubectl, because that path runs no envsubst — so
+    -- the defect was invisible until Flux owned the object, and three runs of Error pods
+    -- were the first sign. Escaping by doubling again would work and would also be the
+    -- next person's trap; plain SQL leaves substitution nothing to touch.
+    --
+    -- has_database_privilege() returns boolean; ::int is 1 when granted and 0 when not, so
+    -- the division raises division_by_zero and ON_ERROR_STOP=1 fails the Job. The divisor
+    -- is not a constant, so it cannot be folded away at plan time.
+    \echo 'asserting cnpg_metrics_exporter has CONNECT on database nextcloud'
+    SELECT 1 / has_database_privilege('cnpg_metrics_exporter', 'nextcloud', 'CONNECT')::int
+      AS exporter_can_connect;