diff --git a/.forgejo/workflows/validate.yaml b/.forgejo/workflows/validate.yaml
index e5d983d..9efdfc5 100644
--- a/.forgejo/workflows/validate.yaml
+++ b/.forgejo/workflows/validate.yaml
@@ -48,17 +48,39 @@ jobs:
           kubectl rollout status deployment/sealed-secrets-controller -n kube-system --timeout=60s
 
       - name: Apply ArgoCD apps
-        run: kubectl apply -f apps/
+        run: |
+          for f in apps/*.yaml; do
+            case "$f" in
+              apps/longhorn.yaml) echo "Skipping $f" ;;
+              *) kubectl apply -f "$f" ;;
+            esac
+          done
 
       - name: Wait for ArgoCD sync
         run: |
-          sleep 10
           kubectl wait applications \
             --all \
             --namespace argocd \
             --for=jsonpath='{.status.health.status}'=Healthy \
             --timeout=300s
 
+      - name: Debug on failure
+        if: failure()
+        run: |
+          echo "=== Applications ==="
+          kubectl get applications -n argocd
+          echo "=== Pods (all namespaces) ==="
+          kubectl get pods --all-namespaces
+          echo "=== Failed pods logs ==="
+          kubectl get pods --all-namespaces --field-selector=status.phase!=Running,status.phase!=Succeeded \
+            -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}' | \
+            while read ns pod; do
+              echo "--- $ns/$pod ---"
+              kubectl logs -n $ns $pod --all-containers --tail=50 2>/dev/null || true
+            done
+          echo "=== Events ==="
+          kubectl get events --all-namespaces --sort-by='.lastTimestamp' | tail -50
+
       - name: Wait for all deployments
         run: kubectl wait --for=condition=available --timeout=300s deployment --all --all-namespaces
 
diff --git a/apps/longhorn.yaml b/apps/longhorn.yaml
new file mode 100644
index 0000000..b76c19f
--- /dev/null
+++ b/apps/longhorn.yaml
@@ -0,0 +1,26 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: longhorn
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://charts.longhorn.io
+    chart: longhorn
+    targetRevision: 1.12.0
+    helm:
+      values: |
+        preUpgradeChecker:
+          jobEnabled: false
+        defaultSettings:
+          defaultReplicaCount: 3
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: longhorn-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true