diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml
index 69e2a0c..22581e7 100644
--- a/platform/vpn-egress/gluetun-gateway.yaml
+++ b/platform/vpn-egress/gluetun-gateway.yaml
@@ -5,14 +5,13 @@
 #
 # CUSTOM-PROVIDER mode (DECISIONS-LOG "Phase 3 VPN — custom .ovpn"): gluetun's PIA-provider server
 # selection random-picks server IPs, many of which don't answer this cluster's flows (intermittent
-# TLS timeouts — verified by packet capture: the pod CAN complete a full handshake, but only against
-# responsive servers). The operator's downloaded PIA `.ovpn` targets `sweden.privacy.network` — a
-# load-balanced hostname that always lands on a healthy server (reliable in GNOME on the host). So we
-# feed gluetun that exact `.ovpn`. Trade-off: custom mode loses gluetun's PIA-native port forwarding
-# (needed only at Phase 6 for qBittorrent) — revisit then.
+# TLS timeouts — verified by packet capture: the pod CAN complete a full handshake, only against
+# responsive servers). So we feed gluetun the operator's own PIA `.ovpn`, which pins a known-healthy
+# Stockholm server IP (gluetun's custom parser requires an IP `remote`, not a hostname). Trade-off:
+# custom mode loses gluetun's PIA-native port forwarding (Phase-6/qBittorrent concern) — revisit then.
 #
 # Credentials: `pia-credentials` SOPS Secret (username/password) → OPENVPN_USER/OPENVPN_PASSWORD (the
-# .ovpn uses auth-user-pass). Config: `pia-custom-ovpn` SOPS Secret (the .ovpn file), mounted at
+# .ovpn uses auth-user-pass). Config: `pia-custom-ovpn` SOPS Secret (key `pia.ovpn`), mounted at
 # /config/pia.ovpn. Both operator-provisioned.
 apiVersion: apps/v1
 kind: Deployment
@@ -35,24 +34,17 @@ spec:
     spec:
       containers:
         - name: gluetun
-          image: qmcgaw/gluetun:v3.41.0        # pinned; Renovate bumps.
+          image: qmcgaw/gluetun:v3.41.3        # pinned; Renovate bumps.
           securityContext:
             capabilities:
               add: ["NET_ADMIN"]               # required for the tunnel + firewall
           env:
             - name: VPN_SERVICE_PROVIDER
-              value: "custom"                # custom .ovpn (sweden.privacy.network) — see header + DECISIONS-LOG
+              value: "custom"                # custom .ovpn — see header + DECISIONS-LOG
             - name: VPN_TYPE
               value: "openvpn"
             - name: OPENVPN_CUSTOM_CONFIG
-              value: "/config/pia.ovpn"      # the operator's PIA .ovpn (pia-custom-ovpn Secret)
-            # gluetun's custom parser needs an IP (not the .ovpn's `remote sweden.privacy.network`
-            # hostname). sweden.privacy.network's load-balanced pool is 158.173.241.{22,34,55,112,239};
-            # pin a currently-healthy one. NOTE: if PIA rotates it out, re-resolve + update.
-            - name: VPN_ENDPOINT_IP
-              value: "158.173.241.22"
-            - name: VPN_ENDPOINT_PORT
-              value: "1198"
+              value: "/config/pia.ovpn"      # the operator's PIA .ovpn (pia-custom-ovpn Secret, IP remote)
             # PIA username/password for the .ovpn's auth-user-pass (pia-credentials SOPS Secret):
             - name: OPENVPN_USER
               valueFrom:
@@ -108,8 +100,7 @@ spec:
           secret:
             secretName: pia-custom-ovpn
             items:
-              # the operator's secret keyed the .ovpn by its filename; map it to /config/pia.ovpn
-              - key: sweden-aes-128-cbc-udp-dns.ovpn
+              - key: pia.ovpn
                 path: pia.ovpn
 ---
 # Control API Service — used for tunnel-state health/alerting (ADR-0013 "alert on tunnel state").