diff --git a/k8s/apps/firefly-iii/kustomization.yaml b/k8s/apps/firefly-iii/kustomization.yaml
index d02ba29..d90eb53 100644
--- a/k8s/apps/firefly-iii/kustomization.yaml
+++ b/k8s/apps/firefly-iii/kustomization.yaml
@@ -50,6 +50,15 @@ patches:
       kind: CronJob
       name: firefly-iii-cron
     patch: |-
+      - op: add
+        path: /spec/concurrencyPolicy
+        value: Forbid
+      - op: add
+        path: /spec/jobTemplate/spec/backoffLimit
+        value: 1
+      - op: add
+        path: /spec/jobTemplate/spec/activeDeadlineSeconds
+        value: 600
       - op: add
         path: /spec/jobTemplate/spec/template/spec/nodeSelector
         value:
@@ -61,6 +70,16 @@ patches:
             operator: Equal
             value: ai
             effect: NoSchedule
+      - op: replace
+        path: /spec/jobTemplate/spec/template/spec/containers/0/command
+        value:
+          - /bin/sh
+          - -ec
+          - >-
+            curl --fail --silent --show-error
+            --retry 30 --retry-delay 10 --retry-all-errors
+            --connect-timeout 5 --max-time 30
+            "http://firefly-iii:80/api/v1/cron/${STATIC_CRON_TOKEN}"
   # A second independent filter in addition to ingressClassName.
   - target:
       group: networking.k8s.io
diff --git a/k8s/apps/firefly-iii/network-policy.yaml b/k8s/apps/firefly-iii/network-policy.yaml
index 3082af4..d98b11e 100644
--- a/k8s/apps/firefly-iii/network-policy.yaml
+++ b/k8s/apps/firefly-iii/network-policy.yaml
@@ -19,6 +19,9 @@ spec:
             matchLabels:
               app.kubernetes.io/instance: firefly-iii
               app.kubernetes.io/name: firefly-iii
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: firefly-data-importer
         # hostNetwork traffic is seen as node traffic rather than Pod traffic.
         - ipBlock:
             cidr: 192.168.1.117/32