diff --git a/apps/base/pdbmux/configmap.yaml b/apps/base/pdbmux/configmap.yaml
index 1238425..bf2b427 100644
--- a/apps/base/pdbmux/configmap.yaml
+++ b/apps/base/pdbmux/configmap.yaml
@@ -6,14 +6,11 @@ metadata:
   namespace: pdbmux
 data:
   PDBMUX_LISTEN: ":8080"
-  # Two PuppetDB backends merged during the VM -> k8s migration:
+  # Two PuppetDB backends merged during the VM -> k8s migration, in precedence
+  # order (first wins ties / pass-through):
+  #   new = the in-cluster k8s PuppetDB (plain HTTP on 8080; in-cluster address
+  #         is preferred over the external gateway to avoid a hairpin)
   #   old = legacy Consul-registered puppetdbapi (reachable from pods via the
   #         Consul DNS the puppet workloads already use)
-  #   new = the in-cluster k8s PuppetDB (plain HTTP on 8080; in-cluster address
-  #         is preferred over the external gateway to avoid a hairpin).
-  PDBMUX_BACKENDS: "old=http://puppetdbapi.service.consul:8080,new=http://puppetdb.puppet.svc.cluster.local:8080"
-  # "new" (the k8s PuppetDB) is the primary for non-merged pass-through and the
-  # preferred backend for ties / static-merge fallback.
-  PDBMUX_PRIMARY: "new"
-  PDBMUX_PREFER: "new"
+  PDBMUX_BACKENDS: "new=http://puppetdb.puppet.svc.cluster.local:8080,old=http://puppetdbapi.service.consul:8080"
   PDBMUX_MERGE: "freshness"
diff --git a/apps/base/pdbmux/deployment.yaml b/apps/base/pdbmux/deployment.yaml
index ae1f23d..827251e 100644
--- a/apps/base/pdbmux/deployment.yaml
+++ b/apps/base/pdbmux/deployment.yaml
@@ -32,8 +32,7 @@ spec:
               name: http
               protocol: TCP
           envFrom:
-            # PDBMUX_LISTEN / PDBMUX_BACKENDS / PDBMUX_PRIMARY / PDBMUX_PREFER /
-            # PDBMUX_MERGE
+            # PDBMUX_LISTEN / PDBMUX_BACKENDS / PDBMUX_MERGE
             - configMapRef:
                 name: pdbmux-env
                 optional: false