diff --git a/passmower/values.yaml b/passmower/values.yaml
index 126e319..5a5a8da 100644
--- a/passmower/values.yaml
+++ b/passmower/values.yaml
@@ -118,6 +118,12 @@ topologySpreadConstraints:
   - maxSkew: 1
     topologyKey: kubernetes.io/hostname
     whenUnsatisfiable: DoNotSchedule
+    # Without this the control-plane nodes count as domains holding zero pods,
+    # so min=0 and any surge pod on a worker computes skew=2 and is rejected,
+    # while the masters themselves are unschedulable due to their taint - the
+    # rolling update deadlocks. Honor excludes nodes whose taints we do not
+    # tolerate from the skew calculation. GA since Kubernetes 1.33.
+    nodeTaintsPolicy: Honor
     labelSelector:
       matchLabels:
         app.kubernetes.io/name: passmower