diff --git a/traefik.yaml b/traefik.yaml
index b9f71f0..cd72834 100644
--- a/traefik.yaml
+++ b/traefik.yaml
@@ -20,16 +20,18 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP — two concurrent keepalived speakers with the
+      # same router-id would fight over the VIP. Never run old+new simultaneously.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   keepalived-backup:
     environment:
@@ -51,16 +53,17 @@ services:
       labels: [traefik.enable=false]
       resources:
         limits: {cpus: '1', memory: 128M}
+      # stop-first: host network + VRRP (see keepalived-master)
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   reverse-proxy:
     image: public.ecr.aws/docker/library/traefik:latest
@@ -128,16 +131,20 @@ services:
         - traefik.http.routers.traefik.middlewares=forwardAuth-authentik@file, crowdsec@file
       resources:
         limits: {cpus: '4', memory: 512M}
+      # stop-first: host-mode published ports (80/443/1883/5201/5431) — a start-first
+      # replacement task can never bind while the old task holds the ports, so
+      # start-first would deadlock/rollback every update. Global mode + parallelism 1
+      # means only one node is briefly down; keepalived VIP + remaining nodes cover it.
       update_config:
         parallelism: 1
         delay: 30s
         failure_action: rollback
         monitor: 15s
-        order: start-first
+        order: stop-first
       rollback_config:
         parallelism: 1
         failure_action: pause
-        order: start-first
+        order: stop-first
 
   traefik-certs-dumper:
     image: ghcr.io/ldez/traefik-certs-dumper:v2.10.0