diff --git a/services/comms/mas-db-ensure-job.yaml b/services/comms/mas-db-ensure-job.yaml
index 8e6666d..9e5cf3b 100644
--- a/services/comms/mas-db-ensure-job.yaml
+++ b/services/comms/mas-db-ensure-job.yaml
@@ -2,15 +2,15 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-db-ensure-8
+  name: mas-db-ensure-9
   namespace: comms
 spec:
-  backoffLimit: 0
+  backoffLimit: 1
   ttlSecondsAfterFinished: 600
   template:
     spec:
       serviceAccountName: mas-db-ensure
-      restartPolicy: OnFailure
+      restartPolicy: Never
       containers:
         - name: ensure
           image: bitnami/kubectl:latest
@@ -18,6 +18,7 @@ spec:
           args:
             - |
               set -eu
+              trap 'echo "mas-db-ensure failed"; sleep 300' ERR
               umask 077
               if kubectl -n comms get secret mas-db >/dev/null 2>&1; then
                 MAS_PASS="$(kubectl -n comms get secret mas-db -o jsonpath='{.data.password}' | base64 -d)"