diff --git a/kubernetes/apps/influxdb/ha-token-job.yaml b/kubernetes/apps/influxdb/ha-token-job.yaml
index 61036c9d..17bcf2c0 100644
--- a/kubernetes/apps/influxdb/ha-token-job.yaml
+++ b/kubernetes/apps/influxdb/ha-token-job.yaml
@@ -133,7 +133,7 @@ spec:
               set -euo pipefail
               log() { printf '[%s] %s\n' "$(date -u +%H:%M:%S)" "$*"; }
 
-              # Need jq + kubectl. influxdb:2.7.4 has neither baked in.
+              # Need jq + kubectl. The influxdb image has neither baked in.
               apt-get update -qq
               apt-get install -y --no-install-recommends curl jq ca-certificates >/dev/null
               KV=$(curl -fsSL https://dl.k8s.io/release/stable.txt)
diff --git a/kubernetes/apps/influxdb/helmrelease.yaml b/kubernetes/apps/influxdb/helmrelease.yaml
index 56721c94..98dff28b 100644
--- a/kubernetes/apps/influxdb/helmrelease.yaml
+++ b/kubernetes/apps/influxdb/helmrelease.yaml
@@ -53,7 +53,8 @@ spec:
   values:
     image:
       repository: influxdb
-      # Match VM 108 for format compatibility with `influx restore`.
+      # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
+      # migration is done. No downgrade below 2.9 without `influxd downgrade`.
       tag: "2.9.1@sha256:db0bdab1e5ad5ee899c127b8c13d9c986a3ced78cd9200dd80a1064bf1533b6e"
     # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
     # backups (pending) is the durability story.
@@ -93,6 +94,12 @@ spec:
     env:
       - name: INFLUXD_STORAGE_WRITE_TIMEOUT
         value: "60s"
+      # 2.9 hashes API tokens on startup by default. Hashed tokens cannot be
+      # read back, so the token Jobs' `influx auth list` reuse would break,
+      # and a downgrade below 2.8 would erase every token (HA, Grafana).
+      # Keep tokens unhashed; enable hashing later as its own change.
+      - name: INFLUXD_USE_HASHED_TOKENS
+        value: "false"
     # The chart defaults to liveness/readiness with initialDelaySeconds=0,
     # so after a crash restart the kubelet kills the pod before shards
     # finish opening. Give it 10 minutes to come up cleanly.