diff --git a/modules/kubernetes/drone/main.tf b/modules/kubernetes/drone/main.tf
index 7a246e33..b8ecede9 100644
--- a/modules/kubernetes/drone/main.tf
+++ b/modules/kubernetes/drone/main.tf
@@ -15,6 +15,9 @@ variable "allowed_users" {
 resource "kubernetes_namespace" "drone" {
   metadata {
     name = "drone"
+    # labels = {
+    #   "istio-injection" : "enabled"
+    # }
   }
 }
 
diff --git a/modules/kubernetes/hackmd/main.tf b/modules/kubernetes/hackmd/main.tf
index 5ecf285f..86790c39 100644
--- a/modules/kubernetes/hackmd/main.tf
+++ b/modules/kubernetes/hackmd/main.tf
@@ -4,6 +4,9 @@ variable "hackmd_db_password" {}
 resource "kubernetes_namespace" "hackmd" {
   metadata {
     name = "hackmd"
+    labels = {
+      "istio-injection" : "enabled"
+    }
   }
 }
 
@@ -25,7 +28,7 @@ resource "kubernetes_deployment" "hackmd" {
   spec {
     replicas = 3
     strategy {
-      type = "Recreate"
+      type = "RollingUpdate" # DB is external so we can roll
     }
     selector {
       match_labels = {
diff --git a/terraform.tfstate b/terraform.tfstate
index db3cb9a3..e70f8489 100644
Binary files a/terraform.tfstate and b/terraform.tfstate differ