diff --git a/deploy/README.md b/deploy/README.md
index 81b9e75..e9264fc 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -8,7 +8,7 @@ the server port or export a copy before applying.
 Apply order is documented in `docs/operator-runbook.md`. Do not apply the
 Deployment until:
 
-1. The image digest is pinned (currently `sha256:c2fe39a0…` from commit `abd22fa`).
+1. The image digest is pinned (currently `sha256:ec15f63d…` from commit `bc3d80f`).
 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
    `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
    applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
diff --git a/deploy/audit-core.yaml b/deploy/audit-core.yaml
index 18a003b..b38ea49 100644
--- a/deploy/audit-core.yaml
+++ b/deploy/audit-core.yaml
@@ -55,10 +55,10 @@ spec:
   replicas: 1
   revisionHistoryLimit: 5
   strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
+    # Recreate, not RollingUpdate: the node is packed to 99% CPU requests, so
+    # maxSurge: 1 cannot schedule a second 50m pod. The Service already has no
+    # ready endpoints, so replacing in place does not add a delivery gap.
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: audit-core
@@ -86,7 +86,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/deploy/migrate-job.yaml b/deploy/migrate-job.yaml
index b4f1b47..95df935 100644
--- a/deploy/migrate-job.yaml
+++ b/deploy/migrate-job.yaml
@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env:
diff --git a/docs/evidence/2026-09-14-readyz-receiver-release.json b/docs/evidence/2026-09-14-readyz-receiver-release.json
new file mode 100644
index 0000000..763b0ca
--- /dev/null
+++ b/docs/evidence/2026-09-14-readyz-receiver-release.json
@@ -0,0 +1,40 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/audit-core:bc3d80f",
+  "native_credentials_used": false,
+  "checks": {
+    "operational_ready": true,
+    "nonroot_readonly": true,
+    "approval-engine": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "informed-decision": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "sigterm": {
+      "exit_code": 0,
+      "inflight_committed_once": true,
+      "restart_retry_duplicate": true,
+      "chain_intact": true
+    }
+  },
+  "started_at": "2026-09-14T20:59:17.605971+00:00",
+  "status": "passed",
+  "own_fixture_cleanup": true,
+  "source_commit": "bc3d80fbd9a23e987d0b775cffcf9d388fc94aa4",
+  "registry_digest": "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
+  "strategy": "Recreate"
+}