diff --git a/apps/pangolin/pangolin-controller-deployment.yaml b/apps/pangolin/pangolin-controller-deployment.yaml
index 7aa8683..4aa6756 100644
--- a/apps/pangolin/pangolin-controller-deployment.yaml
+++ b/apps/pangolin/pangolin-controller-deployment.yaml
@@ -7,7 +7,12 @@ metadata:
     app: pangolin-controller
     component: controller
 spec:
-  replicas: 1
+  # Scaled to 0 after Pangolin DB migration (SQLite -> PostgreSQL, DEV-451):
+  # the fresh Pangolin has no admin user or API key yet, so the controller's
+  # bearer token in pangolin-controller-api-key SealedSecret is invalid.
+  # Re-enable after running Pangolin initial setup and resealing a new key.
+  # Tracked in the follow-up child issue.
+  replicas: 0
   strategy:
     type: Recreate
   selector: