diff --git a/README.md b/README.md
index 1c32e69..2c9d5f6 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,10 @@ to secrets and no delete verbs.
 ## Known quirks (faithful to live state, fix at leisure)
 
 - Most images are `:latest`/`:stable` — deploys are not reproducible until
-  pinned. vaultwarden is pinned (1.35.4).
+  pinned. vaultwarden is pinned (1.35.4); pihole is pinned by digest (Core
+  v6.2.2) after `:latest` silently jumped v5→v6 on a fresh node pull
+  (2026-07-26) and broke DNS for cross-node sources (v6 defaults to
+  `listeningMode=LOCAL`) — fixed via `FTLCONF_dns_listeningMode=ALL`.
 - searxng keeps its helm-generated name suffix (`searxng-1723974683`) because
   deployment selectors are immutable; its helm release record still exists in
   the cluster — don't run `helm upgrade/uninstall` on it, this repo is the
@@ -103,4 +106,8 @@ to secrets and no delete verbs.
   `rpi-master_undervoltage_CNI_corruption_incident-2026-07-25.md`.
 - 2026-07-26: initial import of manifests from live cluster; HA ingress
   defaultBackend fixed; unifiedstreaming-svc LoadBalancer→ClusterIP;
-  pihole/USP secrets moved to secretKeyRef (pending first apply).
+  pihole/USP secrets migrated to secretKeyRef in-cluster.
+- 2026-07-26: pihole surprise v5→v6 upgrade via `:latest` on a fresh node
+  pull; image pinned by digest, `FTLCONF_dns_listeningMode=ALL` +
+  `FTLCONF_webserver_api_password` (v6 ignores WEBPASSWORD), readiness probe
+  on :53 added. Gitea Actions pipeline + deployer RBAC added.
diff --git a/apps/pihole/deployment-pihole.yaml b/apps/pihole/deployment-pihole.yaml
index 8723860..1ef3528 100644
--- a/apps/pihole/deployment-pihole.yaml
+++ b/apps/pihole/deployment-pihole.yaml
@@ -1,7 +1,13 @@
-# DIVERGENCE from live state (intentional): the live deployment has WEBPASSWORD
-# as a plaintext env value. Here it comes from the `pihole-admin` secret —
-# create it (see secret.example.yaml) BEFORE applying this, or the pod will
-# fail with CreateContainerConfigError.
+# Pi-hole v6 (image pinned by digest = Core v6.2.2 — :latest bit us on
+# 2026-07-26 when a fresh node pull silently jumped v5→v6).
+# v6 notes:
+#  - FTLCONF_dns_listeningMode=ALL is REQUIRED in k8s: the v6 default (LOCAL)
+#    only answers queries from directly-attached subnets, which silently drops
+#    all cross-node svclb traffic.
+#  - v6 ignores the old WEBPASSWORD env; the admin password is
+#    FTLCONF_webserver_api_password, fed from the `pihole-admin` secret —
+#    create it (see secret.example.yaml) BEFORE applying.
+#  - Readiness probe on :53 so rollouts wait for FTL to actually serve DNS.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -40,12 +46,14 @@ spec:
                       - raspi
       containers:
         - name: pihole
-          image: pihole/pihole:latest
+          image: pihole/pihole@sha256:e28e239f55e648a9d32c8f065650acfe987ddebf1cd5f64f1c071e8716156ceb # Core v6.2.2
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ
               value: America/Los_Angeles
-            - name: WEBPASSWORD
+            - name: FTLCONF_dns_listeningMode
+              value: ALL
+            - name: FTLCONF_webserver_api_password
               valueFrom:
                 secretKeyRef:
                   name: pihole-admin
@@ -72,6 +80,12 @@ spec:
               memory: 2Gi
           securityContext:
             privileged: true
+          readinessProbe:
+            tcpSocket:
+              port: 53
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 3
           volumeMounts:
             - name: gv-pihole
               mountPath: /etc/pihole