diff --git a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
index 10d3f07..6631196 100644
--- a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
+++ b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
@@ -103,15 +103,26 @@ spec:
             storageClass: standard-rwo
             accessMode: ReadWriteOnce
 
+          # Annotations on the pod template — bumping rollme triggers a
+          # StatefulSet rolling restart (pods 2→1→0) to pick up the
+          # corrected raft retry_join addresses.
+          podAnnotations:
+            rollme: "2026-05-05-raft-join-fix"
+
           readinessProbe:
             enabled: true
-            path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
+            # standbyok=true: standby pods pass (they serve reads).
+            # sealedok removed: sealed/uninit pods fail readiness so they
+            # leave the service endpoints and stop receiving external traffic.
+            path: "/v1/sys/health?standbyok=true"
             initialDelaySeconds: 5
             periodSeconds: 5
             failureThreshold: 3
 
           livenessProbe:
             enabled: true
+            # Liveness keeps sealedok=true so sealed pods aren't killed —
+            # they need time to join raft and auto-unseal.
             path: "/v1/sys/health?standbyok=true&sealedok=true&uninitcode=200"
             initialDelaySeconds: 60
             periodSeconds: 10