diff --git a/infrastructure/traefik/deployment.yaml b/infrastructure/traefik/deployment.yaml
index 19d42465c..076375441 100644
--- a/infrastructure/traefik/deployment.yaml
+++ b/infrastructure/traefik/deployment.yaml
@@ -4,8 +4,6 @@ items:
 - apiVersion: apps/v1
   kind: Deployment
   metadata:
-    annotations:
-      deployment.kubernetes.io/revision: "4"
     name: traefik
     namespace: traefik
   spec:
@@ -73,6 +71,14 @@ items:
           node-role.kubernetes.io/worker: "true"
         affinity:
           nodeAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+              nodeSelectorTerms:
+              - matchExpressions:
+                - key: hardware
+                  operator: In
+                  values:
+                  - rpi5
+                  - rpi4
             preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
               preference:
@@ -103,6 +109,12 @@ items:
                   operator: In
                   values:
                   - rpi4
+          podAntiAffinity:
+            requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: traefik
+              topologyKey: kubernetes.io/hostname
         restartPolicy: Always
         schedulerName: default-scheduler
         serviceAccount: atlas-traefik-ingress-controller
diff --git a/services/keycloak/oneoffs/hermes-access-oidc-client-job.yaml b/services/keycloak/oneoffs/hermes-access-oidc-client-job.yaml
index b189290cc..a61d6c671 100644
--- a/services/keycloak/oneoffs/hermes-access-oidc-client-job.yaml
+++ b/services/keycloak/oneoffs/hermes-access-oidc-client-job.yaml
@@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hermes-access-oidc-client-ensure-2
+  name: hermes-access-oidc-client-ensure-3
   namespace: sso
 spec:
   backoffLimit: 3
diff --git a/services/keycloak/scripts/hermes_access_oidc_ensure.sh b/services/keycloak/scripts/hermes_access_oidc_ensure.sh
index ea68d2dc9..5f390cf16 100755
--- a/services/keycloak/scripts/hermes_access_oidc_ensure.sh
+++ b/services/keycloak/scripts/hermes_access_oidc_ensure.sh
@@ -56,7 +56,8 @@ chat_payload="$(jq -nc \
     baseUrl:"/",
     attributes:{
       "pkce.code.challenge.method":"S256",
-      "post.logout.redirect.uris":$web_origin
+      "post.logout.redirect.uris":$web_origin,
+      "access.token.lifespan":"1200"
     }
   }')"