diff --git a/.gitea/workflows/APP_NAME-build.yaml b/.gitea/workflows/APP_NAME-build.yaml
index 4faf5d3..dac66b3 100644
--- a/.gitea/workflows/APP_NAME-build.yaml
+++ b/.gitea/workflows/APP_NAME-build.yaml
@@ -157,6 +157,21 @@ jobs:
               -e "s|\${DATABASE_NAME}|${DATABASE_NAME}|g" \
               manifests/addonclaim.yaml | kubectl apply -f -
 
+      - name: Esperar rancher-webhook ready (RANCHER-WEBHOOK-RACE-RECOVERY)
+        # Race condition durante el bootstrap del cluster tenant: el
+        # `rancher-webhook` Deployment en cattle-system aún no tiene endpoints
+        # cuando el primer `helm upgrade --install` intenta crear el namespace
+        # `apps`, lo que dispara el webhook
+        # `rancher.cattle.io.namespaces.create-non-kubesystem` y aborta el
+        # release con `no endpoints available for service rancher-webhook`.
+        # El re-dispatch ~5-10min después recupera natural, pero degrada el smoke
+        # E2E. Espera explícita evita el flake.
+        run: |
+          kubectl wait deployment rancher-webhook \
+            -n cattle-system \
+            --for=condition=Available \
+            --timeout=600s
+
       - name: Helm upgrade --install
         env:
           TENANT_ID: ${{ vars.TENANT_ID }}