diff --git a/deploy/k8s/10-deployment.yaml b/deploy/k8s/10-deployment.yaml
index 02da083..c5d4745 100644
--- a/deploy/k8s/10-deployment.yaml
+++ b/deploy/k8s/10-deployment.yaml
@@ -35,11 +35,12 @@ spec:
         reloader.stakater.com/auto: "true"
     spec:
       serviceAccountName: fancy-dns
+      nodeSelector:
+        kubernetes.io/arch: amd64
       imagePullSecrets:
         - name: reg-k6n
-      # No hostNetwork. The server does not set SO_REUSEPORT, so a second
-      # host-network pod would fail to bind :53 and crash-loop; the ports are
-      # served by a LoadBalancer Service instead (see 20-service.yaml).
+      # The pod listens on high ports; Services expose the standard DNS ports.
+      # No hostNetwork, so replicas can share nodes without port collisions.
       dnsPolicy: ClusterFirst
       # The app drains in-flight queries for up to 15s on SIGTERM (see the
       # shutdown timeout in cmd/fancy-dns/main.go); give it room beyond that.