diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 279fbcd..2dc9d36 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -44,11 +44,29 @@ jobs:
             CLUSTER_ROUTE_RETRY_BACKOFF_MS=25
           kubectl patch statefulset/im-server -n im-server-system --type=strategic -p \
             '{"spec":{"template":{"spec":{"containers":[{"name":"im-server","readinessProbe":{"httpGet":{"path":"/healthz","port":6060},"timeoutSeconds":3,"periodSeconds":10,"failureThreshold":3},"livenessProbe":{"httpGet":{"path":"/livez","port":6060},"timeoutSeconds":3,"periodSeconds":20,"failureThreshold":3}}]}}}}'
-          kubectl patch service/im-server -n im-server-system --type=merge -p \
-            '{"spec":{"sessionAffinity":"None"}}'
-          if kubectl get ingress/im-server -n im-server-system >/dev/null 2>&1; then
+          if kubectl auth can-i get services -n im-server-system >/dev/null 2>&1 && \
+             kubectl auth can-i patch services -n im-server-system >/dev/null 2>&1; then
+            kubectl patch service/im-server -n im-server-system --type=merge -p \
+              '{"spec":{"sessionAffinity":"None"}}'
+          else
+            echo "::warning::ci-deployer cannot get/patch Service; skipped sessionAffinity update"
+          fi
+          if kubectl auth can-i get ingresses.networking.k8s.io -n im-server-system >/dev/null 2>&1 && \
+             kubectl auth can-i patch ingresses.networking.k8s.io -n im-server-system >/dev/null 2>&1 && \
+             kubectl get ingress/im-server -n im-server-system >/dev/null 2>&1; then
             kubectl annotate ingress/im-server -n im-server-system --overwrite \
               nginx.ingress.kubernetes.io/load-balance=least_conn
+          else
+            echo "::warning::ci-deployer cannot manage Ingress/im-server or it does not exist; skipped least_conn update"
           fi
           kubectl rollout restart statefulset/im-server -n im-server-system
           kubectl rollout status statefulset/im-server -n im-server-system --timeout=300s
+
+          resources="$(kubectl get statefulset/im-server -n im-server-system -o \
+            jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].resources}')"
+          liveness="$(kubectl get statefulset/im-server -n im-server-system -o \
+            jsonpath='{.spec.template.spec.containers[?(@.name=="im-server")].livenessProbe.httpGet.path}')"
+          echo "effective resources=${resources} liveness=${liveness}"
+          if [ "${liveness}" != "/livez" ] || ! echo "${resources}" | grep -q '"cpu":"2"'; then
+            echo "::warning::StatefulSet resources/probes were reconciled away; update the ArgoCD source kustomization"
+          fi