diff --git a/supabase/deploy.sh b/supabase/deploy.sh
index 39523b9..c984460 100755
--- a/supabase/deploy.sh
+++ b/supabase/deploy.sh
@@ -117,6 +117,17 @@ def ensure_enabled(data, component, enabled):
     deployment = data.setdefault("deployment", {})
     cfg = deployment.setdefault(component, {})
     cfg["enabled"] = bool(enabled)
+    
+    # Also attempt to disable persistence if deployment is disabled
+    if not enabled:
+        persistence = data.setdefault("persistence", {})
+        pvc_cfg = persistence.setdefault(component, {})
+        pvc_cfg["enabled"] = False
+        
+        # Specific known PVC keys that might differ from deployment keys
+        if component == "functions":
+            persistence.setdefault("deno", {})["enabled"] = False
+            persistence.setdefault("snippets", {})["enabled"] = False
 
 def clear_stale_app_scheduling(data):
     deployment = data.get("deployment", {})
@@ -143,6 +154,7 @@ clear_stale_app_scheduling(db_values)
 for component in (
     "analytics",
     "auth",
+    "functions",
     "imgproxy",
     "meta",
     "minio",
@@ -326,7 +338,8 @@ duration_to_seconds() {
 supabase_rollout_status() {
   local ns="$1"
   local kube_context="${2:-}"
-  python3 - "$ns" "$kube_context" <<'PY'
+  local selector="${3:-}"
+  python3 - "$ns" "$kube_context" "$selector" <<'PY'
 import json
 import os
 import subprocess
@@ -334,12 +347,15 @@ import sys
 
 ns = sys.argv[1]
 kube_context = sys.argv[2].strip()
+selector = sys.argv[3].strip()
 
 def kubectl_json(*args):
     cmd = ["kubectl"]
     if kube_context:
         cmd.extend(["--context", kube_context])
     cmd.extend(args)
+    if selector:
+        cmd.extend(["-l", selector])
     out = subprocess.check_output(cmd, text=True)
     return json.loads(out)
 
@@ -428,6 +444,7 @@ wait_for_supabase_ready() {
   local timeout_s="$2"
   local kube_context="${3:-}"
   local scope_label="${4:-Supabase}"
+  local selector="${5:-}"
   local start
   start=$(date +%s)
 
@@ -442,7 +459,12 @@ wait_for_supabase_ready() {
     context_hint="$kube_context"
   fi
 
-  log "Waiting for ${scope_label} readiness in namespace '${ns}' (context=${context_hint}, timeout=${timeout_s}s)..."
+  local selector_hint=""
+  if [[ -n "$selector" ]]; then
+    selector_hint=" (selector=${selector})"
+  fi
+
+  log "Waiting for ${scope_label} readiness in namespace '${ns}' (context=${context_hint}${selector_hint}, timeout=${timeout_s}s)..."
 
   while true; do
     local now elapsed
@@ -450,7 +472,7 @@ wait_for_supabase_ready() {
     elapsed=$((now - start))
 
     local status_json
-    if ! status_json=$(supabase_rollout_status "$ns" "$kube_context" 2>/dev/null); then
+    if ! status_json=$(supabase_rollout_status "$ns" "$kube_context" "$selector" 2>/dev/null); then
       warn "Could not query ${scope_label} rollout status (ns=${ns}, context=${context_hint}); retrying..."
       if (( elapsed >= timeout_s )); then
         return 1
@@ -2420,10 +2442,20 @@ print(base)" 2>/dev/null || true)
 
   local attempt
   attempt=1
+  local app_ready=0
+  local db_frontdoor_ready=0
+
   while (( attempt <= max_attempts )); do
     if (( attempt > 1 )); then
       warn "Retrying Supabase Helm deploy after timeout (attempt ${attempt}/${max_attempts})"
-      force_reset_supabase_namespace
+      
+      if (( app_ready == 1 )); then
+        log "Supabase APP cluster is already healthy; skipping destructive namespace reset."
+      else
+        log "Supabase APP cluster not ready; performing namespace reset."
+        force_reset_supabase_namespace
+      fi
+
       helm_render_values
       setup_knoe_db_for_supabase
       ensure_k8s_supabase_static_pvs "$storage_class"
@@ -2472,16 +2504,23 @@ print(base)" 2>/dev/null || true)
     local wait_enabled
     wait_enabled="${SUPABASE_DEPLOY_WAIT:-true}"
     if [[ "$wait_enabled" == "true" ]]; then
-      local app_ready=0
-      local db_frontdoor_ready=0
+      app_ready=0
+      db_frontdoor_ready=0
 
       if wait_for_supabase_ready "$ns" "$timeout_s" "" "Supabase (APP cluster)"; then
         app_ready=1
+        log "Supabase (APP cluster) is healthy."
+      else
+        warn "Supabase (APP cluster) is NOT ready."
       fi
 
       if [[ "$split_frontdoor_to_db" == "true" ]]; then
-        if wait_for_supabase_ready "$ns" "$timeout_s" "$db_ctx" "Supabase frontdoor (DB cluster)"; then
+        local fd_selector="app.kubernetes.io/instance=${db_frontdoor_release}"
+        if wait_for_supabase_ready "$ns" "$timeout_s" "$db_ctx" "Supabase frontdoor (DB cluster)" "$fd_selector"; then
           db_frontdoor_ready=1
+          log "Supabase frontdoor (DB cluster) is healthy."
+        else
+          warn "Supabase frontdoor (DB cluster) is NOT ready."
         fi
       else
         db_frontdoor_ready=1
@@ -2495,7 +2534,7 @@ print(base)" 2>/dev/null || true)
 
       if (( attempt >= max_attempts )); then
         warn "Supabase Helm deploy did not become Ready within timeout after ${attempt} attempt(s)."
-        # Return a distinct code so k8s mode doesn't fall back to legacy manifests.
+        log "Final status: APP_READY=${app_ready} DB_FRONTDOOR_READY=${db_frontdoor_ready}"
         return 2
       fi
     else