diff --git a/kube-system/descheduler.yaml b/kube-system/descheduler.yaml
index 1412d59..df20cb0 100644
--- a/kube-system/descheduler.yaml
+++ b/kube-system/descheduler.yaml
@@ -48,6 +48,13 @@ data:
           - requiredDuringSchedulingIgnoredDuringExecution
       RemovePodsViolatingNodeTaints:
         enabled: true
+        params:
+          # calico-node flips NetworkUnavailable while it restarts, which the
+          # node lifecycle controller turns into a NoSchedule taint. Without
+          # this exclusion a rolling CNI upgrade evicts every pod in the
+          # cluster (81 pods on 2026-08-23) for a taint that lasts seconds.
+          excludedTaints:
+          - node.kubernetes.io/network-unavailable
       RemovePodsViolatingTopologySpreadConstraint:
         enabled: true
         params: