diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 9ff0c6c..3f1e7ff 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -29,7 +29,9 @@ spec:
     spec:
       containers:
         - name: gluetun
-          image: qmcgaw/gluetun:v3.40.0        # pinned; Renovate bumps
+          image: qmcgaw/gluetun:v3.41.0        # pinned; Renovate bumps. NOTE: PIA+WireGuard support
+                                               # requires >= v3.41 (v3.40.0 rejects "private internet
+                                               # access" as a WireGuard provider — verified at deploy).
           securityContext:
             capabilities:
               add: ["NET_ADMIN"]               # required for the tunnel + firewall