diff --git a/charts/fleet/templates/vulnprocessing/cronjob.yaml b/charts/fleet/templates/vulnprocessing/cronjob.yaml
index 80b739995f1..46a248b917f 100644
--- a/charts/fleet/templates/vulnprocessing/cronjob.yaml
+++ b/charts/fleet/templates/vulnprocessing/cronjob.yaml
@@ -9,6 +9,10 @@ metadata:
     release: {{ .Release.Name }}
   name: fleet-vulnprocessing
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.vulnProcessing.annotations }}
+  annotations:
+    {{- toYaml . | trim | nindent 4 }}
+  {{- end }}
 spec:
   # >>> OPENFRAME(vuln-persistence): optional namespace-derived hourly stagger — openframe/docs/helm-chart.md
   {{- if .Values.vulnProcessing.staggerSchedule }}
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index db8e3a10b49..21b5a9ca402 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -178,6 +178,11 @@ vulnProcessing:
   # When true, `schedule` is ignored and the job runs hourly at a minute derived
   # from the release namespace, so tenants sharing a cluster don't all fire at :00.
   staggerSchedule: false
+  # Extra annotations for the CronJob object. Argo CD users: set
+  # argocd.argoproj.io/ignore-healthcheck: "true" — the built-in CronJob health
+  # check marks it Degraded after a single failed run until the next success,
+  # which otherwise degrades the whole Application (argo-cd issue #24429).
+  annotations: {}
   # Persist FLEET_VULNERABILITIES_DATABASES_PATH (/tmp/vuln) across runs so each
   # run only fetches feed deltas instead of the full ~800MB. Requires dedicated=true.
   persistence: