diff --git a/apps/authentik/values.yaml b/apps/authentik/values.yaml
index 396751a..b9bb500 100644
--- a/apps/authentik/values.yaml
+++ b/apps/authentik/values.yaml
@@ -6,6 +6,12 @@ authentikDeployment:
 
 authentik:
   global:
+    # Server and worker share one ReadWriteOnce Longhorn volume. Recreate stops
+    # the old Pods before replacements start, allowing the volume to move nodes
+    # instead of leaving a rolling update blocked by a multi-attach error.
+    deploymentStrategy:
+      type: Recreate
+
     # CloudNativePG generates this connection Secret. Referencing individual
     # keys avoids duplicating its generated database password in Git or SOPS.
     env: