diff --git a/infrastructure/vault-injector/helmrelease.yaml b/infrastructure/vault-injector/helmrelease.yaml
index d7852737f..4b305675b 100644
--- a/infrastructure/vault-injector/helmrelease.yaml
+++ b/infrastructure/vault-injector/helmrelease.yaml
@@ -33,7 +33,12 @@ spec:
       enabled: false
     injector:
       enabled: true
-      replicas: 1
+      # Two replicas because the webhook is failurePolicy: Ignore. With a
+      # single replica, any pod created while the injector restarts is
+      # admitted unmutated: it comes up without its Vault agent sidecar,
+      # never finds /vault/secrets, and crash-loops indefinitely with no
+      # indication that injection was skipped. Observed twice on ariadne.
+      replicas: 2
       agentImage:
         repository: hashicorp/vault
         tag: "1.17.6"