diff --git a/deploy/k8s/deployment.yaml b/deploy/k8s/deployment.yaml
index 54ffb65c..92e6cc40 100644
--- a/deploy/k8s/deployment.yaml
+++ b/deploy/k8s/deployment.yaml
@@ -19,6 +19,16 @@ metadata:
     app.kubernetes.io/version: "0.1.0"
 spec:
   replicas: 1
+  # One replica on one node with no room to surge. The default
+  # (maxSurge 25% → 1 extra pod) asks for 450m CPU the node does not
+  # have beside the running pod, and the rollout hangs Pending while the
+  # old image keeps serving (tablet 31, 2026-10-04). Replace in place.
+  # The new pod is not Ready until the kohen writes manna (emptyDir).
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: shorashim