diff --git a/services/mailu/helmrelease.yaml b/services/mailu/helmrelease.yaml
index 2de943d0..119b103a 100644
--- a/services/mailu/helmrelease.yaml
+++ b/services/mailu/helmrelease.yaml
@@ -172,15 +172,17 @@ spec:
     clamav:
       image:
         repository: clamav/clamav-debian
-        tag: "1.4"
+        tag: "1.4@sha256:2463487b937071421c0ddadac6616111bedba45b9bd9312bbb4591b57450f8f4"
       logLevel: DEBUG
       nodeSelector:
-        hardware: rpi5
+        # Last-resort CPU capacity while the Pi workers recover; no GPU use.
+        kubernetes.io/hostname: titan-22
         node-role.kubernetes.io/worker: "true"
       resources:
         requests:
           cpu: 200m
-          memory: 1Gi
+          # Signature reloads reached 2453Mi; reserve their working set.
+          memory: 2560Mi
         limits:
           cpu: 500m
           memory: 3Gi