diff --git a/kubernetes/main/apps/networking/nginx/external/helmrelease.yaml b/kubernetes/main/apps/networking/nginx/external/helmrelease.yaml
index dffc35ff8..ff4e0c9d8 100644
--- a/kubernetes/main/apps/networking/nginx/external/helmrelease.yaml
+++ b/kubernetes/main/apps/networking/nginx/external/helmrelease.yaml
@@ -49,6 +49,7 @@ spec:
               values: ["external"]
       allowSnippetAnnotations: true
       config:
+        annotations-risk-level: Critical
         # taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
         block-user-agents: >-
           GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*
diff --git a/kubernetes/main/apps/networking/nginx/internal/helmrelease.yaml b/kubernetes/main/apps/networking/nginx/internal/helmrelease.yaml
index 96d66f71f..260e1dda5 100644
--- a/kubernetes/main/apps/networking/nginx/internal/helmrelease.yaml
+++ b/kubernetes/main/apps/networking/nginx/internal/helmrelease.yaml
@@ -46,6 +46,7 @@ spec:
               values: ["internal"]
       allowSnippetAnnotations: true
       config:
+        annotations-risk-level: Critical
         # taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
         block-user-agents: >-
           GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*
diff --git a/kubernetes/storage/apps/networking/nginx/internal/helmrelease.yaml b/kubernetes/storage/apps/networking/nginx/internal/helmrelease.yaml
index 014b23bfc..1aa9aa34c 100644
--- a/kubernetes/storage/apps/networking/nginx/internal/helmrelease.yaml
+++ b/kubernetes/storage/apps/networking/nginx/internal/helmrelease.yaml
@@ -46,6 +46,7 @@ spec:
               values: ["internal"]
       allowSnippetAnnotations: true
       config:
+        annotations-risk-level: Critical
         # taken from https://github.com/superseriousbusiness/gotosocial/blob/main/internal/web/robots.go
         block-user-agents: >-
           GPTBot,~*GPTBot*,ChatGPT-User,~*ChatGPT-User*,Google-Extended,~*Google-Extended*,CCBot,~*CCBot*,Omgilibot,~*Omgilibot*,FacebookBot,~*FacebookBot*