diff --git a/supabase/helm/knoe-supabase/templates/kong/deployment.yaml b/supabase/helm/knoe-supabase/templates/kong/deployment.yaml
index 1fe9a5d..64811b0 100644
--- a/supabase/helm/knoe-supabase/templates/kong/deployment.yaml
+++ b/supabase/helm/knoe-supabase/templates/kong/deployment.yaml
@@ -14,10 +14,20 @@ spec:
       {{- include "supabase.kong.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.deployment.kong.podAnnotations }}
       annotations:
+        # Tie pod spec to the ConfigMap content hash so `helm upgrade` triggers
+        # a rolling restart whenever kong/config.yaml changes. Without this,
+        # ConfigMap-only changes (like adding a new route) land silently: the
+        # file in /usr/local/kong/template.yml updates via the ConfigMap
+        # volume mount, but Kong loaded declarative config at startup and
+        # doesn't re-read the file on its own -- old pods keep serving stale
+        # config and the new route (e.g. /healthz) is never live. Learned this
+        # the hard way when `helm upgrade` added /healthz but the GCE LB
+        # health check kept getting 404 because live Kong didn't have it.
+        checksum/config: {{ include (print $.Template.BasePath "/kong/config.yaml") . | sha256sum }}
+        {{- with .Values.deployment.kong.podAnnotations }}
         {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- end }}
       labels:
         {{- include "supabase.kong.selectorLabels" . | nindent 8 }}
     spec: