diff --git a/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml b/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml
index b59e9c97..d242c531 100644
--- a/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml
+++ b/kubernetes/infrastructure/rook-ceph-cluster/cephcluster.yaml
@@ -17,6 +17,33 @@ spec:
     modules:
       - name: pg_autoscaler
         enabled: true
+  # CVE-2025-30156: CephX AES-128-CBC service tickets carry no HMAC and use a
+  # hard-coded IV, so a holder of any low-privilege key can bit-flip a ticket
+  # into cluster-admin. The fix is rotating keys to the aes256k cipher —
+  # upgrading the binaries alone does not close it. Rotation is opt-in and
+  # defaults to Disabled, so it must be requested here.
+  #
+  # Daemon keys only. CSI keys stay on aes: aes256k over the CSI mount path
+  # needs a host kernel of 7.0 or newer and these nodes run 6.18. `aes`
+  # therefore has to remain in auth_allowed_ciphers for CSI to authenticate,
+  # which leaves AUTH_INSECURE_CLIENT_KEY_TYPE, AUTH_INSECURE_KEYS_ALLOWED and
+  # AUTH_INSECURE_KEYS_CREATABLE raised. Revisit once the nodes run a kernel
+  # that supports it.
+  #
+  # Rotating the daemon keys clears AUTH_INSECURE_SERVICE_KEY_TYPE, the only
+  # one of the six checks at ERR severity. That matters beyond the CVE itself:
+  # Rook skips CephFS and RGW reconciliation entirely while health is
+  # HEALTH_ERR, and that check is currently held down only by a mon-side mute
+  # with a finite TTL.
+  #
+  # keyType is deliberately unset — Rook picks the best type for daemon keys.
+  # To rotate again later, increment keyGeneration; Rook restarts the daemons
+  # to pick up the new keys.
+  security:
+    cephx:
+      daemon:
+        keyRotationPolicy: KeyGeneration
+        keyGeneration: 2
   # Bump CephFS subvolume cloner pool from 4 → 16. Velero CSI Snapshot
   # Data Movement provisions a backupPVC per source PVC by cloning the
   # VolumeSnapshot, and a 4-thread default stalls migrate-immich's