diff --git a/services/nextcloud/deployment.yaml b/services/nextcloud/deployment.yaml
index 9558e82b..13ee7e5b 100644
--- a/services/nextcloud/deployment.yaml
+++ b/services/nextcloud/deployment.yaml
@@ -8,6 +8,12 @@ metadata:
     app: nextcloud
 spec:
   replicas: 1
+  # These volumes are RWO; release the old pod before replacing it.
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app: nextcloud
@@ -18,6 +24,7 @@ spec:
       annotations:
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-requests-cpu: "25m"
         vault.hashicorp.com/role: "nextcloud"
         vault.hashicorp.com/agent-inject-secret-nextcloud-env.sh: "kv/data/atlas/nextcloud/nextcloud-db"
         vault.hashicorp.com/agent-inject-template-nextcloud-env.sh: |
@@ -55,7 +62,7 @@ spec:
       serviceAccountName: nextcloud-vault
       initContainers:
         - name: seed-nextcloud-web
-          image: nextcloud:29-apache
+          image: nextcloud:29-apache@sha256:a7fbfcd4759bdd19b8fb8b1044b47ee3a9471d2e2c8bc68d56a2e671f86cebd2
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -104,7 +111,7 @@ spec:
               mountPath: /var/www/html/config/extra.config.php
               subPath: extra.config.php
         - name: install-nextcloud
-          image: nextcloud:29-apache
+          image: nextcloud:29-apache@sha256:a7fbfcd4759bdd19b8fb8b1044b47ee3a9471d2e2c8bc68d56a2e671f86cebd2
           securityContext:
             runAsUser: 0
             runAsGroup: 0
@@ -196,7 +203,7 @@ spec:
               subPath: extra.config.php
       containers:
         - name: nextcloud
-          image: nextcloud:29-apache
+          image: nextcloud:29-apache@sha256:a7fbfcd4759bdd19b8fb8b1044b47ee3a9471d2e2c8bc68d56a2e671f86cebd2
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "-c"]
           args:
@@ -235,6 +242,14 @@ spec:
           ports:
             - containerPort: 80
               name: http
+          readinessProbe:
+            httpGet:
+              path: /status.php
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
           volumeMounts:
             - name: nextcloud-web
               mountPath: /var/www/html
@@ -250,7 +265,8 @@ spec:
           resources:
             requests:
               cpu: 250m
-              memory: 1Gi
+              # Measured 24-hour peak: 394Mi; burst limit stays at 3Gi.
+              memory: 512Mi
             limits:
               cpu: 1
               memory: 3Gi