diff --git a/kubernetes/apps/matter-server/deployment.yaml b/kubernetes/apps/matter-server/deployment.yaml
index d30c8e01..31c03da1 100644
--- a/kubernetes/apps/matter-server/deployment.yaml
+++ b/kubernetes/apps/matter-server/deployment.yaml
@@ -16,26 +16,26 @@ spec:
       labels:
         app.kubernetes.io/name: matter-server
       annotations:
-        # Multus attaches a second NIC (net1) on k8s-edge's v30iot VLAN
-        # via macvlan (see network-attachment.yaml). Matter device
+        # Multus attaches a second NIC (net1) on the v30iot VLAN via
+        # macvlan (see network-attachment.yaml). Matter device
         # commissioning and discovery need real L2 presence on the IoT
         # subnet — multicast send/receive — which a Cilium-managed pod
         # IP or a LoadBalancer Service IP cannot provide. The NAD pins
-        # 10.2.30.226 statically; the nodeSelector below keeps the pod
-        # on k8s-edge, the only node with the v30iot bridge.
+        # 10.2.30.226 statically and uses master: eth1, which is the
+        # v30iot interface on every node (k8s-1/2/3 and k8s-edge alike),
+        # so this pod is no longer tied to k8s-edge.
         k8s.v1.cni.cncf.io/networks: matter-server-iot
     spec:
       # Cluster pod network is the primary attachment (eth0, used by HA
       # → matter-server via the ClusterIP Service and matter-server →
       # OTBR via OTBR's ClusterIP Service). The macvlan attachment
       # above is additive, not a replacement.
-      nodeSelector:
-        topology.kubernetes.io/zone: edge
-      tolerations:
-        - key: workload-class
-          operator: Equal
-          value: pinned
-          effect: NoSchedule
+      #
+      # No nodeSelector/toleration: this pod only needs v30iot (present
+      # on all nodes), not the edge USB devices. Dropping the
+      # workload-class=pinned toleration lets the edge taint keep it off
+      # the (tiny) edge box, reserving that node for the USB-bound
+      # home-assistant + zwave-js pods.
       containers:
         - name: matter-server
           # Use the HAOS-published image from `ghcr.io/matter-js/...`,
diff --git a/kubernetes/apps/music-assistant/deployment.yaml b/kubernetes/apps/music-assistant/deployment.yaml
index c69229e3..db5373ac 100644
--- a/kubernetes/apps/music-assistant/deployment.yaml
+++ b/kubernetes/apps/music-assistant/deployment.yaml
@@ -17,8 +17,8 @@ spec:
       labels:
         app.kubernetes.io/name: music-assistant
     spec:
-      # Host networking attaches MA to the edge node's L2 VLANs
-      # directly. The node's second NIC is on v30iot, so the pod sits
+      # Host networking attaches MA to the node's L2 VLANs directly.
+      # Every node's second NIC (eth1) is on v30iot, so the pod sits
       # on the IoT VLAN with the audio clients (Snapcast / SlimProto /
       # Chromecast). Those protocols sync audio across group members
       # and require all members to share an L2 broadcast domain;
@@ -30,13 +30,12 @@ spec:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
       enableServiceLinks: false
-      nodeSelector:
-        topology.kubernetes.io/zone: edge
-      tolerations:
-        - key: workload-class
-          operator: Equal
-          value: pinned
-          effect: NoSchedule
+      # No nodeSelector/toleration: MA only needs a node on v30iot (all
+      # of them) for audio-sync L2, not the edge USB devices. It's the
+      # heaviest of the formerly edge-pinned pods (2Gi limit), so
+      # dropping the workload-class=pinned toleration — which lets the
+      # edge taint keep it off the tiny edge box — is the main capacity
+      # win for this step.
       containers:
         - name: music-assistant
           image: ghcr.io/music-assistant/server:2.9.4 # {"$imagepolicy": "flux-system:music-assistant"}
diff --git a/kubernetes/apps/otbr/deployment.yaml b/kubernetes/apps/otbr/deployment.yaml
index 33da4aa1..f9ce22ea 100644
--- a/kubernetes/apps/otbr/deployment.yaml
+++ b/kubernetes/apps/otbr/deployment.yaml
@@ -21,13 +21,11 @@ spec:
         # the IoT VLAN for mDNS/SRP advertisements and RA listening.
         k8s.v1.cni.cncf.io/networks: otbr-iot
     spec:
-      nodeSelector:
-        topology.kubernetes.io/zone: edge
-      tolerations:
-        - key: workload-class
-          operator: Equal
-          value: pinned
-          effect: NoSchedule
+      # No nodeSelector/toleration: OTBR only needs v30iot L2 presence
+      # (macvlan master: eth1, present on every node), not the edge USB
+      # devices, and its Thread RCP is reached over the network
+      # (slzb-thread.renner.uno). Dropping the workload-class=pinned
+      # toleration lets the edge taint keep it off the tiny edge box.
       containers:
         # The Thread RCP lives on a SLZB-06 over Ethernet at
         # slzb-thread.renner.uno:6638 (Serial-over-IP). otbr-agent's