diff --git a/current/overlays/dev/api-queue-redis-envfrom-patch.yaml b/current/overlays/dev/api-queue-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..4229468
--- /dev/null
+++ b/current/overlays/dev/api-queue-redis-envfrom-patch.yaml
@@ -0,0 +1,7 @@
+# Same override as api-redis-envfrom-patch.yaml, applied to api-queue
+# (php artisan queue:work redis).
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-dev-redis
diff --git a/current/overlays/dev/api-redis-envfrom-patch.yaml b/current/overlays/dev/api-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..2aa1022
--- /dev/null
+++ b/current/overlays/dev/api-redis-envfrom-patch.yaml
@@ -0,0 +1,8 @@
+# Same pattern as www-redis-envfrom-patch.yaml: point REDIS_HOST/PORT/SCHEME/
+# PASSWORD at the in-cluster ValKey instance instead of the DO-managed Redis
+# in api-secrets, via a dedicated secretRef appended last in envFrom.
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-dev-redis
diff --git a/current/overlays/dev/api-worker-redis-envfrom-patch.yaml b/current/overlays/dev/api-worker-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..cf181a6
--- /dev/null
+++ b/current/overlays/dev/api-worker-redis-envfrom-patch.yaml
@@ -0,0 +1,8 @@
+# Same override as api-redis-envfrom-patch.yaml, applied to api-worker
+# (php artisan schedule:work — also uses Redis for withoutOverlapping mutex
+# locks; see api's CLAUDE.md scheduled-jobs section).
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-dev-redis
diff --git a/current/overlays/dev/kustomization.yaml b/current/overlays/dev/kustomization.yaml
index 5e7a6a1..9ffc13c 100644
--- a/current/overlays/dev/kustomization.yaml
+++ b/current/overlays/dev/kustomization.yaml
@@ -34,14 +34,26 @@ patches:
   target:
     kind: Deployment
     name: api
+- path: api-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api
 - path: api-queue-scale-patch.yaml
   target:
     kind: Deployment
     name: api-queue
+- path: api-queue-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api-queue
 - path: api-worker-scale-patch.yaml
   target:
     kind: Deployment
     name: api-worker
+- path: api-worker-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api-worker
 - path: www-worker-scale-patch.yaml
   target:
     kind: Deployment
diff --git a/current/overlays/prod/api-queue-redis-envfrom-patch.yaml b/current/overlays/prod/api-queue-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..31f7d1a
--- /dev/null
+++ b/current/overlays/prod/api-queue-redis-envfrom-patch.yaml
@@ -0,0 +1,9 @@
+# Same override as api-redis-envfrom-patch.yaml, applied to api-queue
+# (php artisan queue:work redis). No active job dispatches exist in the app
+# today (UpdateControllerHoursJob::dispatch() is commented out), so there is
+# no in-flight-job-loss risk from this cutover.
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-prod-redis
diff --git a/current/overlays/prod/api-redis-envfrom-patch.yaml b/current/overlays/prod/api-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..c20052e
--- /dev/null
+++ b/current/overlays/prod/api-redis-envfrom-patch.yaml
@@ -0,0 +1,13 @@
+# Same pattern as www-redis-envfrom-patch.yaml: point REDIS_HOST/PORT/SCHEME/
+# PASSWORD at the in-cluster ValKey instance instead of the DO-managed Redis
+# in api-secrets, via a dedicated secretRef appended last in envFrom.
+#
+# Do NOT sync this ahead of api's fixed image (env('REDIS_SCHEME')-aware
+# config/database.php) being live in prod — the old hardcoded 'tls' scheme
+# will TLS-handshake against this plain-TCP ValKey and crash, exactly as
+# happened with www/www-worker during the `current` cutover.
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-prod-redis
diff --git a/current/overlays/prod/api-worker-redis-envfrom-patch.yaml b/current/overlays/prod/api-worker-redis-envfrom-patch.yaml
new file mode 100644
index 0000000..b3ebe51
--- /dev/null
+++ b/current/overlays/prod/api-worker-redis-envfrom-patch.yaml
@@ -0,0 +1,10 @@
+# Same override as api-redis-envfrom-patch.yaml, applied to api-worker
+# (php artisan schedule:work — also uses Redis for withoutOverlapping mutex
+# locks; see api's CLAUDE.md scheduled-jobs section). Existing locks simply
+# won't exist in the new store, which is harmless — it's equivalent to every
+# mutex being freshly released.
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    secretRef:
+      name: valkey-prod-redis
diff --git a/current/overlays/prod/kustomization.yaml b/current/overlays/prod/kustomization.yaml
index c8f078f..88b02f9 100644
--- a/current/overlays/prod/kustomization.yaml
+++ b/current/overlays/prod/kustomization.yaml
@@ -28,6 +28,18 @@ patches:
   target:
     kind: Deployment
     name: api
+- path: api-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api
+- path: api-queue-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api-queue
+- path: api-worker-redis-envfrom-patch.yaml
+  target:
+    kind: Deployment
+    name: api-worker
 images:
 - name: vatusa/api
   newName: vatusa/api