diff --git a/stacks/instagram-poster/modules/instagram-poster/main.tf b/stacks/instagram-poster/modules/instagram-poster/main.tf
index 3d9ef98c..2308f7b1 100644
--- a/stacks/instagram-poster/modules/instagram-poster/main.tf
+++ b/stacks/instagram-poster/modules/instagram-poster/main.tf
@@ -542,6 +542,14 @@ resource "kubernetes_cron_job_v1" "ig_refresh_token" {
     labels    = local.labels
   }
   spec {
+    # Suspended 2026-05-12 — chronic JobFailed because the deployed image
+    # (currently :da5b4191) doesn't yet contain the `POST /ig-refresh-token`
+    # FastAPI route. The route is in the working copy at
+    # `instagram-poster/instagram_poster/app.py:695` but uncommitted, so
+    # the cron returns 404 every night. Unsuspend after the new image
+    # rolls (commit + push to instagram-poster repo, GHA builds + Woodpecker
+    # deploys, then remove this `suspend = true` line).
+    suspend                       = true
     schedule                      = "0 2 * * *"
     concurrency_policy            = "Forbid"
     successful_jobs_history_limit = 1
diff --git a/stacks/payslip-ingest/main.tf b/stacks/payslip-ingest/main.tf
index f5f42d32..5782092f 100644
--- a/stacks/payslip-ingest/main.tf
+++ b/stacks/payslip-ingest/main.tf
@@ -334,6 +334,13 @@ resource "kubernetes_cron_job_v1" "actualbudget_payroll_sync" {
     namespace = kubernetes_namespace.payslip_ingest.metadata[0].name
   }
   spec {
+    # Suspended 2026-05-12 — chronic JobFailed with
+    # `KeyError: 'ACTUALBUDGET_API_KEY'` / `..._ENCRYPTION_PASSWORD`.
+    # Vault `secret/payslip-ingest` now has `actualbudget_api_key` and
+    # `actualbudget_budget_sync_id` (copied from `secret/fire-planner`),
+    # but `actualbudget_encryption_password` is still missing. Unsuspend
+    # by removing this line once the encryption password is in Vault.
+    suspend                       = true
     schedule                      = "0 2 * * *"
     concurrency_policy            = "Forbid"
     successful_jobs_history_limit = 3