diff --git a/clusters/atlas/flux-system/applications/jenkins/kustomization.yaml b/clusters/atlas/flux-system/applications/jenkins/kustomization.yaml
index 5cf8d56d..ff3625a3 100644
--- a/clusters/atlas/flux-system/applications/jenkins/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/jenkins/kustomization.yaml
@@ -16,6 +16,7 @@ spec:
     name: flux-system
   targetNamespace: jenkins
   dependsOn:
+    - name: core
     - name: helm
     - name: harbor
     - name: vault-hermes-jenkins-token-seed
diff --git a/infrastructure/modules/base/priorityclass/jenkins.yaml b/infrastructure/modules/base/priorityclass/jenkins.yaml
new file mode 100644
index 00000000..bec27119
--- /dev/null
+++ b/infrastructure/modules/base/priorityclass/jenkins.yaml
@@ -0,0 +1,17 @@
+# infrastructure/modules/base/priorityclass/jenkins.yaml
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-core
+value: 500
+globalDefault: false
+description: "For the Jenkins controller; must outrank the build agents it owns"
+---
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: jenkins-agent
+value: 50
+globalDefault: false
+preemptionPolicy: Never
+description: "For ephemeral Jenkins build agents; lower than the controller and non-preempting"
diff --git a/infrastructure/modules/base/priorityclass/kustomization.yaml b/infrastructure/modules/base/priorityclass/kustomization.yaml
index d83776b7..ba2022aa 100644
--- a/infrastructure/modules/base/priorityclass/kustomization.yaml
+++ b/infrastructure/modules/base/priorityclass/kustomization.yaml
@@ -4,5 +4,6 @@ kind: Kustomization
 resources:
   - scavenger.yaml
   - cassandra.yaml
+  - jenkins.yaml
   - media.yaml
   - veles.yaml
diff --git a/services/jenkins/configmap-jcasc.yaml b/services/jenkins/configmap-jcasc.yaml
index fcb87234..9ca05395 100644
--- a/services/jenkins/configmap-jcasc.yaml
+++ b/services/jenkins/configmap-jcasc.yaml
@@ -795,6 +795,7 @@ data:
               slaveConnectTimeoutStr: "100"
               yaml: |
                 spec:
+                  priorityClassName: jenkins-agent
                   securityContext:
                     runAsUser: 1000
                     runAsGroup: 1000
diff --git a/services/jenkins/deployment.yaml b/services/jenkins/deployment.yaml
index 46109da7..ab9029a5 100644
--- a/services/jenkins/deployment.yaml
+++ b/services/jenkins/deployment.yaml
@@ -71,6 +71,12 @@ spec:
         bstein.dev/restarted-at: "2026-05-20T09:40:31Z"
     spec:
       serviceAccountName: jenkins
+      # The controller must outrank the build agents it schedules. Without this
+      # the controller and its agents are both priority 0, so a Recreate
+      # rollout can free the controller's slot only for one of its own agents
+      # to take it, leaving the controller permanently Pending with the
+      # scheduler reporting "No preemption victims found for incoming pod".
+      priorityClassName: jenkins-core
       nodeSelector:
         kubernetes.io/arch: arm64
         node-role.kubernetes.io/worker: "true"