diff --git a/passmower/kustomization.yaml b/passmower/kustomization.yaml
index 522b552..e17fefd 100644
--- a/passmower/kustomization.yaml
+++ b/passmower/kustomization.yaml
@@ -11,7 +11,7 @@ helmCharts:
   releaseName: *name
   repo: oci://ghcr.io/passmower/charts
   valuesFile: values.yaml
-  version: 2.4.0
+  version: 2.4.1
 
 resources:
 - ssh://git@git.k-space.ee/secretspace/kube/passmower # secrets: email-credentials, github-client, slack-client
diff --git a/passmower/values.yaml b/passmower/values.yaml
index 606e354..126e319 100644
--- a/passmower/values.yaml
+++ b/passmower/values.yaml
@@ -108,3 +108,17 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
+
+# Spread the replicas one per node. Without this the scheduler packs two onto
+# whichever worker is emptiest, the descheduler's RemoveDuplicates strategy
+# calls that a duplicate and evicts one every --descheduling-interval (5m),
+# and the replacement lands on the same node again - an eviction loop that
+# shows up as pod churn with zero container restarts.
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: DoNotSchedule
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: passmower
+        app.kubernetes.io/instance: passmower