diff --git a/bootstrap/kubeadm/init-cp.sh b/bootstrap/kubeadm/init-cp.sh
index 08ae335..b3e0dee 100755
--- a/bootstrap/kubeadm/init-cp.sh
+++ b/bootstrap/kubeadm/init-cp.sh
@@ -25,13 +25,13 @@ install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube
 # CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8)
 kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"
 
-# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
-kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
-kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
-kubectl -n argocd rollout status deploy/argocd-server --timeout=600s
-kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"
-
 # Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh
 kubeadm token create --print-join-command > /opt/selfheal/join.sh
 chmod 600 /opt/selfheal/join.sh
-echo "control plane ready; join command in /opt/selfheal/join.sh"
+
+# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
+# Argo CD pods only schedule once workers have joined (the CP keeps its NoSchedule taint), so do not wait here.
+kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
+kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
+kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"
+echo "control plane ready; join the workers (join command in /opt/selfheal/join.sh), then: kubectl -n argocd rollout status deploy/argocd-server"