diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index f071b75..ed4ebb7 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -54,10 +54,10 @@ spec:
             - name: VPN_TYPE
               value: "openvpn"               # OpenVPN-UDP — satisfies "protocol != TCP" (R-NET); ADR-0013 amended
             - name: PIA_ENCRYPTION_PRESET
-              value: "strong"                # operator's working .ovpn (sweden.privacy.network:1197) uses PIA's
-                                             # STRONG preset: RSA-4096 + AES-256-CBC + SHA256. gluetun defaults
-                                             # to "normal" (AES-128-GCM) → cipher mismatch, so the 1197 endpoint
-                                             # never completes the handshake. "strong" also selects port 1197.
+              value: "normal"                # PIA "normal": RSA-2048 + AES-128-CBC + SHA1, port 1198 (matches the
+                                             # operator's downloaded lower-encryption .ovpn). Chosen over "strong"
+                                             # (RSA-4096): the smaller handshake fits the pod's 1450 MTU (Cilium
+                                             # VXLAN) reliably, where RSA-4096 was marginal and wouldn't hold.
             # Fresh server list comes from the update-servers initContainer (see above). UPDATER_PERIOD then
             # keeps it fresh for long-running pods (gluetun docs: >=360h to be nice to the provider API):
             - name: UPDATER_PERIOD
@@ -69,10 +69,6 @@ spec:
               value: "1300"                  # tun-mtu: extra margin under the 1450 pod MTU (data channel)
             - name: OPENVPN_MSSFIX
               value: "1300"                  # clamp TCP-in-tunnel to match
-            - name: OPENVPN_FLAGS
-              value: "--hand-window 120 --mtu-disc no"   # --mtu-disc no clears the DF bit so oversized RSA-4096
-                                             # handshake packets FRAGMENT through the 1450 pod MTU instead of being
-                                             # silently dropped; --hand-window 120 gives the handshake more time.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: