diff --git a/.gitlab/ci/test-on-cng/main.gitlab-ci.yml b/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
index 736bc2adc49d18145120411f347ef7e5a2933b4b..5e71e65eb6ba8882d48bea65d18f962af76990b7 100644
--- a/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
+++ b/.gitlab/ci/test-on-cng/main.gitlab-ci.yml
@@ -98,6 +98,7 @@ workflow:
         --admin-password "${GITLAB_ADMIN_PASSWORD}" \
         --admin-token "${GITLAB_QA_ADMIN_ACCESS_TOKEN}" \
         --chart-sha "${GITLAB_HELM_CHART_REF}" \
+        --retry 1 \
         --ci \
         ${EXTRA_DEPLOY_VALUES}
   after_script:
diff --git a/qa/gems/gitlab-cng/lib/gitlab/cng/lib/deployment/installation.rb b/qa/gems/gitlab-cng/lib/gitlab/cng/lib/deployment/installation.rb
index 79ecf04898630fe60395b338e63ad44509c4d8b6..61e6085a274d76e3c014740fd519e4806664294e 100644
--- a/qa/gems/gitlab-cng/lib/gitlab/cng/lib/deployment/installation.rb
+++ b/qa/gems/gitlab-cng/lib/gitlab/cng/lib/deployment/installation.rb
@@ -182,7 +182,7 @@ def run_pre_deploy_setup
         # @param [String] chart_reference
         # @return [void]
         def run_deploy(chart_reference)
-          args = []
+          args = ["--atomic"]
           args.push(*component_version_values.flat_map { |v| ["--set", v] }) if ci
           args.push("--set", cli_values.join(",")) unless cli_values.empty?
           values = DefaultValues.common_values(gitlab_domain)
@@ -194,7 +194,14 @@ def run_deploy(chart_reference)
             .to_yaml
 
           Helpers::Spinner.spin("running helm deployment") do
-            helm.upgrade(name, chart_reference, namespace: namespace, timeout: timeout, values: values, args: args)
+            opts = {
+              namespace: namespace,
+              timeout: timeout,
+              values: values,
+              # remove --atomic on last attempt so failed deployment is not removed on failure
+              args: @deployment_attempts == retry_attempts ? args.reject { |a| a == "--atomic" } : args
+            }
+            helm.upgrade(name, chart_reference, **opts)
           rescue Helm::Client::Error => e
             @deployment_attempts += 1
             handle_deploy_failure(e) if @deployment_attempts > retry_attempts
diff --git a/qa/gems/gitlab-cng/spec/unit/gitlab/cng/deployment/installation_spec.rb b/qa/gems/gitlab-cng/spec/unit/gitlab/cng/deployment/installation_spec.rb
index 56235a93450ef3a1c1dd5bca7cf2fdbbe449edd2..50fe87eb4f761dc4596de905641f3d4da54d8c37 100644
--- a/qa/gems/gitlab-cng/spec/unit/gitlab/cng/deployment/installation_spec.rb
+++ b/qa/gems/gitlab-cng/spec/unit/gitlab/cng/deployment/installation_spec.rb
@@ -135,7 +135,16 @@
 
         it "retries deployment" do
           expect { expect { installation.create }.to raise_error(SystemExit) }.to output.to_stdout
-          expect(helmclient).to have_received(:upgrade).twice
+          expect(helmclient).to have_received(:upgrade).with(
+            "gitlab",
+            chart_reference,
+            hash_including(args: ["--atomic"])
+          )
+          expect(helmclient).to have_received(:upgrade).with(
+            "gitlab",
+            chart_reference,
+            hash_including(args: [])
+          )
         end
       end
     end