diff --git a/apps/monitoring/loki-deployment.yaml b/apps/monitoring/loki-deployment.yaml
index ef2c662..4336dd4 100644
--- a/apps/monitoring/loki-deployment.yaml
+++ b/apps/monitoring/loki-deployment.yaml
@@ -10,11 +10,12 @@ spec:
   selector:
     matchLabels:
       app: loki
+  # loki-storage-encrypted is RWO on hcloud-volumes-encrypted, so a rolling
+  # update deadlocks (new pod cannot attach the PVC while the old pod holds
+  # it). Recreate drops the old pod first so the CSI detaches the volume
+  # before the new pod tries to attach it. Same pattern as harbor's RWO fix.
   strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
+    type: Recreate
   template:
     metadata:
       labels: