diff --git a/tracks/cka/bank_hard.py b/tracks/cka/bank_hard.py
index 12a6420..0e5a50a 100644
--- a/tracks/cka/bank_hard.py
+++ b/tracks/cka/bank_hard.py
@@ -78,7 +78,12 @@ now=$(nx "$CP" 'awk "/hostPath:/{getline; p=\$2} /name: etcd-data/{if (p) print
 # the same directory name as before is fine if it was rebuilt from the snapshot after seeding
 m=$(nx "$CP" "stat -c %Y $now/member 2>/dev/null" </dev/null); [ -n "$m" ] && [ "$m" -gt "$t0" ]"""),
   C("control plane healthy: etcd, apiserver, scheduler, controller-manager Running", 2, r"""j -n default cm %{cm} '{.data.proof}' | grep -q -- '-%{cm}$' || exit 1   # only once restored
-for c in etcd kube-apiserver kube-scheduler kube-controller-manager; do eq "$(j -n kube-system pod -l component=$c '{.items[0].status.phase}')" Running || exit 1; done"""),
+# right after a restore the API holds the snapshot's mirror pods and the kubelet replaces them, so a
+# grade in the first minute can find one missing - retry instead of failing on that window
+for i in $(seq 1 20); do
+  ok=1; for c in etcd kube-apiserver kube-scheduler kube-controller-manager; do eq "$(j -n kube-system pod -l component=$c '{.items[0].status.phase}')" Running || ok=0; done
+  [ $ok = 1 ] && exit 0; sleep 3
+done; exit 1"""),
  ],
 },
 {
@@ -446,7 +451,7 @@ by `kubectl config view --minify`, to `{WS}/q64/ns.txt`.
  "checks": [
   C("Deployment %{dep} in %{ns} (the context's namespace), 2 available, owner=ac", 3, r"""eq "$(j -n %{ns} deploy %{dep} '{.status.availableReplicas}')" 2 && { eq "$(j -n %{ns} deploy %{dep} '{.metadata.labels.owner}')" ac || eq "$(j -n %{ns} deploy %{dep} '{.spec.template.metadata.labels.owner}')" ac; }"""),
   C("Service %{dep} port 9000 in the same namespace", 1, r"""eq "$(j -n %{ns} svc %{dep} '{.spec.ports[0].port}')" 9000"""),
-  C("nothing was created in namespace default by mistake", 1, r"""! $K -n default get deploy %{dep} >/dev/null 2>&1"""),
+  C("nothing was created in namespace default by mistake", 1, r"""$K -n %{ns} get deploy %{dep} >/dev/null 2>&1 && ! $K -n default get deploy %{dep} >/dev/null 2>&1"""),
   C("ns.txt has the namespace", 1, r"""eq "$(tr -d '[:space:]' < "$WS/q64/ns.txt" 2>/dev/null)" %{ns}"""),
  ],
 },