diff --git a/apps/base/puppet/deployment_puppetserver-master.yaml b/apps/base/puppet/deployment_puppetserver-master.yaml
index 189b901..8f76b2a 100644
--- a/apps/base/puppet/deployment_puppetserver-master.yaml
+++ b/apps/base/puppet/deployment_puppetserver-master.yaml
@@ -4,6 +4,8 @@ metadata:
   annotations:
     configmap.reloader.stakater.com/auto: "true"
     secret.reloader.stakater.com/reload: "vault-ca-cert"
+    # Replace clears the stale, API-server-defaulted spec.strategy.rollingUpdate that SSA cannot drop, which otherwise makes Recreate invalid.
+    argocd.argoproj.io/sync-options: Replace=true
   labels:
     app.kubernetes.io/component: puppetserver
     app.kubernetes.io/instance: puppetserver