diff --git a/platform/longhorn/helmrelease.yaml b/platform/longhorn/helmrelease.yaml
index 090abc2..a434558 100644
--- a/platform/longhorn/helmrelease.yaml
+++ b/platform/longhorn/helmrelease.yaml
@@ -11,6 +11,10 @@ metadata:
   namespace: longhorn-system
 spec:
   interval: 30m
+  # Longhorn upgrades roll every workload + engine image on slow HDD-backed nodes and can exceed the
+  # 5m Helm default; a short timeout caused a W5 mid-upgrade wedge (data migrated to the new minor but
+  # workloads rolled back, and the new-version data refuses the old-version manager). Give it room.
+  timeout: 15m0s
   chart:
     spec:
       chart: longhorn
@@ -26,6 +30,10 @@ spec:
   upgrade:
     remediation:
       retries: 3
+      # NEVER auto-rollback a Longhorn minor upgrade: once the on-disk data migrates to the new minor,
+      # the older manager fatally refuses it ("downgrading from vX to vY is not supported"). Rolling
+      # back the workloads while data is already migrated wedges the cluster. Fail forward instead.
+      remediateLastFailure: false
   values:
     # We own the StorageClasses (storageclasses.yaml) so the default 3-replica class and the bulk
     # tier are explicit and GitOps-managed. Disable the chart's built-in default SC so there is