diff --git a/traefik/logrotate/traefik-logrotate.sh b/traefik/logrotate/traefik-logrotate.sh
index 1242043..5ddfe44 100644
--- a/traefik/logrotate/traefik-logrotate.sh
+++ b/traefik/logrotate/traefik-logrotate.sh
@@ -1 +1,29 @@
-IyEvdXNyL2Jpbi9lbnYgYmFzaAojIFdyYXBwZXIgaW52b2tlZCBieSBjcm9uIG9uIGRvY2tlci0xL2RvY2tlci0yL2RvY2tlci0zIHRvIHJvdGF0ZSB0aGUgc2hhcmVkCiMgVHJhZWZpayBhY2Nlc3MvZXJyb3IgbG9ncyAoc2VlIHRyYWVmaWstbG9ncy5jb25mIGZvciB0aGUgImZ1bGwgd2h5IikuCiMKIyBCZWNhdXNlIC92b2x1bWUxL2RvY2tlci90cmFlZmlrL2xvZ3MgaXMgdGhlIFNBTUUgcGh5c2ljYWwgQ2VwaEZTIHBhdGggb24KIyBhbGwgdGhyZWUgbm9kZXMsIGFuZCBjcm9uIG9uIGFsbCB0aHJlZSBub2RlcyBydW5zIHRoaXMgaW5kZXBlbmRlbnRseSwgd2UKIyB1c2UgYSBzaGFyZWQgZmxvY2sgKGFsc28gb24gdGhlIENlcGhGUyBtb3VudCwgc28gaXQncyB2aXNpYmxlIGNsdXN0ZXItd2lkZSkKIyB0byBndWFyYW50ZWUgb25seSBvbmUgbm9kZSBhY3R1YWxseSBleGVjdXRlcyBsb2dyb3RhdGUgYXQgYSB0aW1lLCBhbmQgYQojIFNIQVJFRCBzdGF0ZSBmaWxlIHNvIHdoaWNoZXZlciBub2RlIHJ1bnMgaXQga25vd3MgdGhlIHRydWUgbGFzdC1yb3RhdGVkCiMgdGltZSByZWdhcmRsZXNzIG9mIHdoaWNoIG5vZGUgcm90YXRlZCBpdCBsYXN0LiBJZiBhIG5vZGUgaXMgZG93biwgdGhlCiMgb3RoZXIgdHdvIHN0aWxsIGNvdmVyIHRoZSBzY2hlZHVsZSAtLSBub25lIG9mIHRoaXMgcmVsaWVzIG9uIGEgc3BlY2lmaWMKIyBub2RlIGJlaW5nIHVwLgpzZXQgLWV1byBwaXBlZmFpbAoKTE9DS19ESVI9Ii92b2x1bWUxL2RvY2tlci90cmFlZmlrL2xvZ3JvdGF0ZS1zdGF0ZSIKTE9DS19GSUxFPSIkTE9DS19ESVIvcm90YXRlLmxvY2siClNUQVRFX0ZJTEU9IiRMT0NLX0RJUi9zdGF0dXMiCkNPTkZfRklMRT0iL2V0Yy9sb2dyb3RhdGUuZC90
\ No newline at end of file
+#!/usr/bin/env bash
+# Wrapper invoked by cron on docker-1/docker-2/docker-3 to rotate the shared
+# Traefik access/error logs (see traefik-logs.conf for the "full why").
+#
+# Because /volume1/docker/traefik/logs is the SAME physical CephFS path on
+# all three nodes, and cron on all three nodes runs this independently, we
+# use a shared flock (also on the CephFS mount, so it's visible cluster-wide)
+# to guarantee only one node actually executes logrotate at a time, and a
+# SHARED state file so whichever node runs it knows the true last-rotated
+# time regardless of which node rotated it last. If a node is down, the
+# other two still cover the schedule -- none of this relies on a specific
+# node being up.
+set -euo pipefail
+
+LOCK_DIR="/volume1/docker/traefik/logrotate-state"
+LOCK_FILE="$LOCK_DIR/rotate.lock"
+STATE_FILE="$LOCK_DIR/status"
+CONF_FILE="/etc/logrotate.d/traefik-logs"
+
+mkdir -p "$LOCK_DIR"
+touch "$STATE_FILE"
+
+exec 200>"$LOCK_FILE"
+if ! flock -n 200; then
+  # Another node already holds the lock this cycle -- normal, not an error.
+  exit 0
+fi
+
+/usr/sbin/logrotate -s "$STATE_FILE" "$CONF_FILE"