diff --git a/vaultwarden/deployment-vaultwarden.yaml b/vaultwarden/deployment-vaultwarden.yaml
index 3adccad..afb363a 100644
--- a/vaultwarden/deployment-vaultwarden.yaml
+++ b/vaultwarden/deployment-vaultwarden.yaml
@@ -15,11 +15,11 @@ spec:
   selector:
     matchLabels:
       app: vaultwarden
+  # Single-replica vaultwarden on a RWO local-path PVC (SQLite + WAL): Recreate
+  # avoids two pods briefly racing the same db.sqlite3 during a roll
+  # (RollingUpdate surges a 2nd pod first).
   strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
+    type: Recreate
   template:
     metadata:
       labels:
@@ -33,7 +33,7 @@ spec:
           value: 'true'
         envFrom:
         - secretRef:
-            name: vaultwarden-secret
+            name: vaultwarden-secret-infisical
         image: vaultwarden/server:1.35.4
         imagePullPolicy: Always
         name: vaultwarden