diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 4f47db1..c8f8260 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -66,9 +66,13 @@ spec:
             # DATA-channel packets fit (the handshake is small so this wasn't the connect blocker, but the
             # data channel needs it). Hardcoded strings (int-coercion gotcha). See DECISIONS-LOG.
             - name: OPENVPN_MTU
-              value: "1350"
+              value: "1300"                  # tun-mtu: extra margin under the 1450 pod MTU (data channel)
             - name: OPENVPN_MSSFIX
-              value: "1350"
+              value: "1300"                  # clamp TCP-in-tunnel to match
+            - name: OPENVPN_FLAGS
+              value: "--tls-mtu 1200 --hand-window 120"   # shrink the CONTROL-channel packets (RSA-4096 strong
+                                             # preset handshake) so they fit reliably under 1450, and give the
+                                             # handshake longer than the default 60s to complete over a lossy path.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: