Cold pod connection storms

After each rolling deploy, freshly started pods show a 20-30 second window of elevated p99 and a burst of connection reset / handshake-timeout errors to your database and a downstream gRPC service, then settle. It's not GC or JIT, profiling shows the time going into establishing new TCP+TLS connections and the DB driver doing per-connection auth. The connection pools are configured lazy (min-idle = 0), so a fresh pod opens connections only as the first requests arrive, right when the LB hits it at full traffic. How do you triage and fix this cold-start?