diff --git a/SPECS.md b/SPECS.md
index bd61b6b..10c4229 100644
--- a/SPECS.md
+++ b/SPECS.md
@@ -138,6 +138,14 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
+  NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
+  the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported
+  both as "configured" while `kubectl diff -k k8s/` was empty (owner). Expected: "unchanged".
+  Validated offline (kustomize + kubeconform); not applied by me. Also found: the in-app update
+  check failed with an IOException because the cluster's `FORGE_TOKEN` was still the template
+  placeholder — the forge refuses it and the server answers 502; `apply -k` does not include
+  the Secrets, so a new token needs `kubectl apply -f k8s/secrets/secrets.yaml` and a restart.
 - 2026-10-25 — App 2.35.3: a car build with the English EVHardware (comments, log lines, the
   "Layer" names); no change in behaviour. Emulator: starts, no crash, the log reads
   "Layer1: …" to "Layer5: …". Not tried on the car.
diff --git a/k8s/influxdb.yaml b/k8s/influxdb.yaml
index 03247a5..20edc3f 100644
--- a/k8s/influxdb.yaml
+++ b/k8s/influxdb.yaml
@@ -84,11 +84,16 @@ spec:
       volumes:
         - name: config
           emptyDir: {}
+  # apiVersion, kind and volumeMode are the values Kubernetes fills in itself: written out, a
+  # repeated apply finds nothing to patch (no "configured" for an unchanged StatefulSet).
   volumeClaimTemplates:
-    - metadata:
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
         name: data
       spec:
         accessModes: ["ReadWriteOnce"]
+        volumeMode: Filesystem
         # No storageClassName: the cluster's default class is used.
         resources:
           requests:
@@ -132,3 +137,4 @@ spec:
               app.kubernetes.io/name: grafana
       ports:
         - port: 8086
+          protocol: TCP