diff --git a/kubernetes/apps/navidrome/beets.yaml b/kubernetes/apps/navidrome/beets.yaml
index e890f1f5..7a1c2c63 100644
--- a/kubernetes/apps/navidrome/beets.yaml
+++ b/kubernetes/apps/navidrome/beets.yaml
@@ -2,9 +2,9 @@
 # It never moves, copies, renames or deletes a file: Lidarr and Navidrome
 # paths stay valid. Navidrome picks up the new tags on its hourly scan.
 #
-# Safety gate (REN-350): `import.write: no` and the art plugins off. Tags go
-# into the beets DB only; `beet write -p` prints what a write would change.
-# After the report and a 5-album spot check, a follow-up PR sets write: yes.
+# REN-350: two dry runs with write: no were checked (match report and a
+# 5-album spot check), so beets now writes tags. Art plugins stay off: they
+# would add or embed cover files, a separate change.
 #
 # Lidarr does not write tags: lidarr-reconcile sets writeAudioTags "no" on
 # every pod start (lidarr.yaml), so it cannot undo the beets tags.
@@ -42,7 +42,7 @@ data:
         media: ['CD', 'Digital Media|File']
         original_year: yes
     import:
-      write: no
+      write: yes
       copy: no
       move: no
       link: no
@@ -55,7 +55,7 @@ data:
       resume: no
       # Never "remove": that deletes files.
       duplicate_action: skip
-    # Both write files into /music; off until write: yes.
+    # Both add or change cover art in /music; not part of the tag fix.
     fetchart:
       auto: no
     embedart:
@@ -79,12 +79,20 @@ data:
     echo "== albums in library: $(beet ls -a | wc -l)"
     echo "== skipped this run: $(grep -c '^skip ' "$LOG")"
     echo "== duplicates skipped: $(grep -c '^duplicate-skip ' "$LOG")"
+    # Incremental import does not revisit albums matched in the dry runs;
+    # `beet write` puts their DB tags into the files (tags only, no move).
     beet write -p > /config/logs/write-preview.txt 2>&1
-    echo "== items whose file tags differ from the DB: $(grep -vc '^ ' /config/logs/write-preview.txt)"
+    echo "== items to write: $(grep -vc '^ ' /config/logs/write-preview.txt)"
+    beet write
+    wrc=$?
+    echo "== write exit $wrc"
+    beet write -p > /config/logs/write-after.txt 2>&1
+    echo "== items still differing after write: $(grep -vc '^ ' /config/logs/write-after.txt)"
     echo "== skipped albums"
     grep '^skip ' "$LOG"
-    echo "== write preview (first 600 lines)"
+    echo "== written changes (first 600 lines)"
     head -n 600 /config/logs/write-preview.txt
+    [ "$rc" -eq 0 ] && rc=$wrc
     exit $rc
 ---
 apiVersion: batch/v1
@@ -140,9 +148,9 @@ spec:
                 - name: beets-config
                   mountPath: /etc/beets
                   readOnly: true
+                # Writable for tag writes; move/copy/delete stay off above.
                 - name: music
                   mountPath: /music
-                  readOnly: true
               resources:
                 requests:
                   cpu: 100m