diff --git a/services/jenkins/lesavka-userns-probe.yaml b/services/jenkins/lesavka-userns-probe.yaml
index 048e7a4a..ed8e78cb 100644
--- a/services/jenkins/lesavka-userns-probe.yaml
+++ b/services/jenkins/lesavka-userns-probe.yaml
@@ -13,7 +13,7 @@ data:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: lesavka-userns-probe-2
+  name: lesavka-userns-probe-3
   namespace: jenkins
 spec:
   backoffLimit: 0
@@ -41,6 +41,9 @@ spec:
         # exception is confined to a hostUsers:false pod with no host mounts.
         seccompProfile:
           type: Unconfined
+        # The CRI default denies userns_create even inside an isolated pod.
+        appArmorProfile:
+          type: Unconfined
       containers:
         - name: probe
           image: registry.bstein.dev/bstein/lesavka-ci@sha256:7d3a2548ef0df8da053a2e2939675f5a3cf23e26517828e5fa9a3185911a8e75