diff --git a/cluster/cloudflared/deployment.yaml b/cluster/cloudflared/deployment.yaml
index fc5b0b5..8552160 100644
--- a/cluster/cloudflared/deployment.yaml
+++ b/cluster/cloudflared/deployment.yaml
@@ -6,6 +6,13 @@ metadata:
   namespace: cloudflared
 spec:
   replicas: 3
+  # With required anti-affinity and 3 worker nodes, a surge pod can never
+  # schedule — replace in place instead.
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app: cloudflared
@@ -24,12 +31,19 @@ spec:
       containers:
         - name: cloudflared
           image: cloudflare/cloudflared:latest
-          imagePullPolicy: IfNotPresent
+          # Always pull so :latest actually tracks upstream instead of a
+          # per-node cached digest
+          imagePullPolicy: Always
           args:
             - tunnel
             - --no-autoupdate
             - --metrics
             - 0.0.0.0:2000
+            # Reconnects retry forever; --retries caps the backoff interval
+            # (1s * 2^retries, jittered). 1 = retry every ~2s max, no
+            # exponential growth.
+            - --retries
+            - "1"
             - run
           env:
             - name: TUNNEL_TOKEN
@@ -37,6 +51,15 @@ spec:
                 secretKeyRef:
                   name: tunnel-token
                   key: token
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
           ports:
             - name: metrics
               containerPort: 2000
@@ -47,6 +70,10 @@ spec:
               port: 2000
             initialDelaySeconds: 10
             periodSeconds: 10
+            # Tolerate long edge outages: let cloudflared's own fast retry
+            # loop reconnect instead of killing the pod into CrashLoopBackOff
+            # (which backs off exponentially up to 5m).
+            failureThreshold: 30
           resources:
             requests:
               memory: "64Mi"