diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index 1b241bf..f914a87 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -21,10 +21,13 @@ OpenSandbox chart 所有权边界。
 
 ## Canary 安全边界
 
-- Deployment 为单副本，滚动策略固定 `maxSurge: 0`、`maxUnavailable: 1`，避免两个
-  scheduler 共享同一个 Gitea runner 身份。
+- Deployment 为单副本，滚动策略固定 `maxSurge: 1`、`maxUnavailable: 0`，保证新
+  facade Ready 后才终止旧实例。scheduler 必须通过 Kubernetes Lease 保持单 leader，
+  不能依赖 Recreate 避免重复领取。
 - controller 的 single-flight gate 只允许一个已领取 task 运行；Gitea 接受终态
   `UpdateTask` 后才领取下一条。`POD_CAPACITY=1` 同时限制 worker 创建并发。
+- rollout 重叠期间只有持有 `Lease/dynamic-runner-scheduler` 的 controller 执行
+  `FetchTask`；所有 Ready 实例都可通过 backend metadata 恢复 claim 并服务 facade。
 - executor 镜像使用 digest；Pod 以 UID 2000 运行，SPIRE `ClusterStaticEntry` 同时绑定
   具体 Pod UID 与 `unix:uid:2000`。
 - facade 只有 ClusterIP，executor 通过
diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml
index 8e346f2..deda86c 100644
--- a/platform/dynamic-runner/deployment.yaml
+++ b/platform/dynamic-runner/deployment.yaml
@@ -8,8 +8,8 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 0
-      maxUnavailable: 1
+      maxSurge: 1
+      maxUnavailable: 0
   selector:
     matchLabels:
       app.kubernetes.io/name: dynamic-runner-controller
@@ -38,7 +38,7 @@ spec:
               mountPath: /trust
       containers:
         - name: controller
-          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:efbe44fdb13cf24f83f92d703c7051d3106cfc7d3bed9ee5debddd1d27db9dec
+          image: zot.ad.ddupan.top/panxiao81/gitea-dynamic-runner-controller@sha256:c165a0ec950fb5972acb9f4010c0a9cb1b89fb6c9f95c78b36cc0cbdf6f482b7
           imagePullPolicy: IfNotPresent
           args: [controller]
           env:
diff --git a/platform/dynamic-runner/rbac.yaml b/platform/dynamic-runner/rbac.yaml
index 5dd3a7b..6f875e9 100644
--- a/platform/dynamic-runner/rbac.yaml
+++ b/platform/dynamic-runner/rbac.yaml
@@ -19,6 +19,9 @@ rules:
   - apiGroups: [""]
     resources: [pods]
     verbs: [create, get, list, watch, patch, delete]
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    verbs: [create, get, list, watch, update, patch]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding