diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 81296e89..61b0c147 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -17,7 +17,12 @@ spec:
   template:
     metadata:
       labels:
+        # `tier: hot` distinguishes these pods from prop-backfill (same
+        # app: prop label) so the Service selector can exclude backfill
+        # from its endpoint pool — backfill runs PHX_SERVER=false and
+        # doesn't listen on :5000.
         app: prop
+        tier: hot
     spec:
       tolerations:
         - key: node-role.kubernetes.io/control-plane
diff --git a/k8s/service.yaml b/k8s/service.yaml
index 8df5abc4..3fc249a0 100644
--- a/k8s/service.yaml
+++ b/k8s/service.yaml
@@ -11,6 +11,11 @@ spec:
       timeoutSeconds: 3600
   selector:
     app: prop
+    # Exclude prop-backfill (tier: backfill) — it runs PHX_SERVER=false
+    # and doesn't listen on :5000. A pre-tier-label deploy caused a
+    # Cloudflare 502 when ClientIP affinity pinned a source to the
+    # backfill endpoint.
+    tier: hot
   ports:
     - name: http
       port: 5000