diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index bda931fc..b299c970 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -4,9 +4,9 @@ metadata:
   name: prop
   namespace: prop
 spec:
-  # replicas is owned by the HPA in hpa.yaml (currently pinned at 1).
-  # Leaving it out here so the GitOps reconciler doesn't overwrite
-  # whatever replica count the autoscaler has settled on.
+  # replicas is owned by the HPA in hpa.yaml (floor 2, max 4). Leaving
+  # it out here so the GitOps reconciler doesn't overwrite whatever
+  # replica count the autoscaler has settled on.
   minReadySeconds: 5
   strategy:
     type: RollingUpdate
diff --git a/k8s/hpa.yaml b/k8s/hpa.yaml
index c5b86272..a42a3d0f 100644
--- a/k8s/hpa.yaml
+++ b/k8s/hpa.yaml
@@ -22,11 +22,13 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: prop
-  # Pinned at 1 pod (min == max). HPA still owns the replica count so
-  # Flux reconcile stays out of the way; raise both bounds together to
-  # restore autoscaling.
-  minReplicas: 1
-  maxReplicas: 1
+  # Floor at 2 pods so a single-pod restart never takes the site down,
+  # surge up to 4 under load (LiveView burst + hourly propagation
+  # chain). Combined with deployment.yaml's `maxSurge: 1, maxUnavailable: 0`
+  # rolling-update strategy, deploys still get an extra pod up before
+  # tearing one down.
+  minReplicas: 2
+  maxReplicas: 4
   metrics:
     - type: Resource
       resource: