diff --git a/services/mailu/mailu-sync-cronjob.yaml b/services/mailu/mailu-sync-cronjob.yaml
index 671439d..bbe9909 100644
--- a/services/mailu/mailu-sync-cronjob.yaml
+++ b/services/mailu/mailu-sync-cronjob.yaml
@@ -38,6 +38,9 @@ spec:
               {{- with secret "kv/data/atlas/mailu/mailu-initial-account-secret" -}}{{ .Data.data.password }}{{- end -}}
         spec:
           restartPolicy: OnFailure
+          nodeSelector:
+            kubernetes.io/arch: arm64
+            node-role.kubernetes.io/worker: "true"
           serviceAccountName: mailu-vault-sync
           containers:
             - name: mailu-sync
diff --git a/services/mailu/mailu-sync-listener.yaml b/services/mailu/mailu-sync-listener.yaml
index b3d2acc..0644c5b 100644
--- a/services/mailu/mailu-sync-listener.yaml
+++ b/services/mailu/mailu-sync-listener.yaml
@@ -30,7 +30,7 @@ spec:
         app: mailu-sync-listener
       annotations:
         vault.hashicorp.com/agent-inject: "true"
-        atlas.bstein.dev/mailu-sync-rev: "3"
+        atlas.bstein.dev/mailu-sync-rev: "4"
         vault.hashicorp.com/role: "mailu-mailserver"
         vault.hashicorp.com/agent-inject-secret-mailu-db-secret__database: "kv/data/atlas/mailu/mailu-db-secret"
         vault.hashicorp.com/agent-inject-template-mailu-db-secret__database: |
@@ -52,6 +52,9 @@ spec:
           {{- with secret "kv/data/atlas/mailu/mailu-initial-account-secret" -}}{{ .Data.data.password }}{{- end -}}
     spec:
       restartPolicy: Always
+      nodeSelector:
+        kubernetes.io/arch: arm64
+        node-role.kubernetes.io/worker: "true"
       serviceAccountName: mailu-vault-sync
       containers:
         - name: listener