diff --git a/apps/base/jellyfin/valkey.yaml b/apps/base/jellyfin/valkey.yaml
index bd018a3..147895b 100644
--- a/apps/base/jellyfin/valkey.yaml
+++ b/apps/base/jellyfin/valkey.yaml
@@ -1,14 +1,21 @@
 ---
-# Single-instance Valkey managed by valkey-operator, replacing the self-managed
-# redis Deployment as Jellyfin's distributed transcode-session store. shards:1 +
-# replicas:0 is one primary with no replicas. This operator always runs Valkey
-# cluster-mode-enabled with protected-mode off and leaves the built-in `default`
-# user passwordless, so clients connect with no auth/TLS (parity with the old
-# open redis); StackExchange.Redis auto-discovers the single node. HA (more
-# shards/replicas) is a follow-up. Persistence is intentionally omitted so /data
-# is an emptyDir: the lease state is ephemeral, and the operator-managed PVC
-# cannot carry the k8up.io/backup:"false" annotation the namespace's cluster-wide
-# k8up Schedule needs to skip an in-use RWO volume.
+# HA Valkey managed by valkey-operator as Jellyfin's distributed transcode-session
+# store. shards:1 + replicas:2 is one primary with two replicas in a single shard
+# group (three ValkeyNodes total): losing the primary triggers an automatic
+# failover to a replica, so a node/pod loss no longer drops the shared transcode
+# lease state the two Jellyfin replicas coordinate through. The operator always
+# runs Valkey cluster-mode-enabled with protected-mode off and leaves the built-in
+# `default` user passwordless, so clients connect with no auth/TLS (parity with the
+# old open redis); StackExchange.Redis seeds off the single headless service and
+# auto-discovers the topology plus failovers, so the connection string is
+# unchanged. scheduling.node.spread.shard:Required renders pod anti-affinity that
+# keeps the three nodes on distinct hosts (kubernetes.io/hostname), so one host
+# loss removes at most one node. podDisruptionBudget.mode:Cluster lets the operator
+# manage a quorum-aware PDB. Persistence stays omitted so /data is an emptyDir:
+# lease state is ephemeral (30s TTLs), replication+failover already provide
+# redundancy and a replaced node re-syncs from the primary, and an operator-managed
+# PVC cannot carry the k8up.io/backup:"false" annotation the namespace's
+# cluster-wide k8up Schedule needs to skip in-use RWO volumes.
 apiVersion: valkey.io/v1alpha1
 kind: ValkeyCluster
 metadata:
@@ -16,10 +23,17 @@ metadata:
   namespace: jellyfin
 spec:
   shards: 1
-  replicas: 0
+  replicas: 2
   image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
   exporter:
     enabled: false
+  scheduling:
+    node:
+      spread:
+        shard:
+          mode: Required
+  podDisruptionBudget:
+    mode: Cluster
   resources:
     requests:
       cpu: 50m