diff --git a/README.md b/README.md
index 5b7e62c..dce1748 100644
--- a/README.md
+++ b/README.md
@@ -149,6 +149,13 @@ for linux/amd64, like the SOyA web-cli it contains.
 service, certificate (cert-manager, ClusterIssuer `letsencrypt-prod`) and ingress
 (nginx).
 
+The deployment runs two replicas with 16 threads each (`RAILS_MAX_THREADS`).
+Replicas keep no state of their own: every check is answered by one replica
+from the criteria and structures in the image. A replica whose threads are all
+busy fails its readiness probe (`/version`) and is taken out of the ingress
+until it answers again; the liveness probe only checks that the port is open, so
+a busy replica is not restarted.
+
 ## Tests
 
 ```
diff --git a/kubernetes/deployment.yaml b/kubernetes/deployment.yaml
index 2e07003..32af619 100644
--- a/kubernetes/deployment.yaml
+++ b/kubernetes/deployment.yaml
@@ -3,7 +3,12 @@ kind: Deployment
 metadata:
   name: dpplint
 spec:
-  replicas: 1
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
   selector:
     matchLabels:
       app: dpplint
@@ -25,10 +30,12 @@ spec:
           value: production
         - name: DIDLINT_URL
           value: https://didlint.ownyourdata.eu
+        - name: RAILS_MAX_THREADS
+          value: "16"
         resources:
           requests:
             cpu: 100m
-            memory: 384Mi
+            memory: 512Mi
           limits:
             memory: 1Gi
         readinessProbe:
@@ -36,10 +43,13 @@ spec:
             path: /version
             port: 3000
           initialDelaySeconds: 10
-          periodSeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 2
+          failureThreshold: 2
         livenessProbe:
-          httpGet:
-            path: /up
+          tcpSocket:
             port: 3000
           initialDelaySeconds: 30
           periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 3