diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 6e19fb0..4f47db1 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -53,10 +53,11 @@ spec:
               value: "private internet access"
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
-            - name: OPENVPN_ENDPOINT_PORT
-              value: "8080"                  # NOT 1197: with live servers, PIA's replies FROM src-port 1197 get
-                                             # no return here — the home OpenVPN server / port-forward on 1197
-                                             # appears to swallow them. 8080 avoids that (PIA serves it too).
+            - name: PIA_ENCRYPTION_PRESET
+              value: "strong"                # operator's working .ovpn (sweden.privacy.network:1197) uses PIA's
+                                             # STRONG preset: RSA-4096 + AES-256-CBC + SHA256. gluetun defaults
+                                             # to "normal" (AES-128-GCM) → cipher mismatch, so the 1197 endpoint
+                                             # never completes the handshake. "strong" also selects port 1197.
             # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then
             # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API):
             - name: UPDATER_PERIOD