diff --git a/services/vault/vault-statefulset.yaml b/services/vault/vault-statefulset.yaml
index 581a536..c5a125b 100644
--- a/services/vault/vault-statefulset.yaml
+++ b/services/vault/vault-statefulset.yaml
@@ -16,8 +16,16 @@ spec:
     spec:
       serviceAccountName: vault # Allows k8s auth for autounsealing
       terminationGracePeriodSeconds: 10
-      # Force pods onto different physical server nodes
       affinity:
+        # 1. Pin the pods strictly to K3s server nodes
+        # nodeAffinity:
+        #   requiredDuringSchedulingIgnoredDuringExecution:
+        #     nodeSelectorTerms:
+        #     - matchExpressions:
+        #       - key: node-role.kubernetes.io/control-plane
+        #         operator: Exists
+
+        # 2. Force those pods onto different physical server nodes
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             - labelSelector: