diff --git a/kubernetes/apps/default/immich/app/configmap.yaml b/kubernetes/apps/default/immich/app/configmap.yaml
index ed6a308ea..ebf1d0735 100644
--- a/kubernetes/apps/default/immich/app/configmap.yaml
+++ b/kubernetes/apps/default/immich/app/configmap.yaml
@@ -5,8 +5,8 @@ metadata:
   name: immich-configmap
   namespace: default
 data:
-  IMMICH_MACHINE_LEARNING_URL: http://immich-machine-learning.default.svc.cluster.local.:3003
-  IMMICH_SERVER_URL: http://immich-server.default.svc.cluster.local.:3001
+  IMMICH_MACHINE_LEARNING_URL: http://immich-machine-learning.default.svc.cluster.local:3003
+  IMMICH_SERVER_URL: http://immich-server.default.svc.cluster.local:3001
   LOG_LEVEL: verbose
   REDIS_DBINDEX: "15"
   REDIS_HOSTNAME: redis.database.svc.cluster.local.
diff --git a/kubernetes/apps/default/immich/app/machine-learning/helmrelease.yaml b/kubernetes/apps/default/immich/app/machine-learning/helmrelease.yaml
index 087b173d3..90df691dd 100644
--- a/kubernetes/apps/default/immich/app/machine-learning/helmrelease.yaml
+++ b/kubernetes/apps/default/immich/app/machine-learning/helmrelease.yaml
@@ -18,8 +18,6 @@ spec:
         namespace: flux-system
   dependsOn:
     - name: immich-server
-    - name: redis
-      namespace: database
   values:
     controllers:
       main:
@@ -32,17 +30,33 @@ spec:
             image:
               repository: ghcr.io/immich-app/immich-machine-learning
               tag: v1.93.3
-            envFrom:
-              - configMapRef:
-                  name: *configMap
-              - secretRef:
-                  name: *secret
+            env:
+              IMMICH_MEDIA_LOCATION: &mediaLocation /usr/src/app/upload
+              MACHINE_LEARNING_HOST: 0.0.0.0
+              MACHINE_LEARNING_PORT: &port 3003
+              MACHINE_LEARNING_CACHE_FOLDER: /cache
+              TRANSFORMERS_CACHE: /cache
             resources:
               requests:
                 cpu: 100m
                 memory: 274M
               limits:
                 memory: 3949M
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
         pod:
           enableServiceLinks: false
           securityContext:
@@ -61,14 +75,14 @@ spec:
       main:
         ports:
           http:
-            port: 3003
+            port: *port
     persistence:
       library:
         type: nfs
         server: "${LOCAL_LAN_TRUENAS}"
         path: /mnt/storage/apps/immich
         globalMounts:
-          - path: /usr/src/app/upload
+          - path: *mediaLocation
       cache:
         type: persistentVolumeClaim
         existingClaim: immich-machine-learning-cache
diff --git a/kubernetes/apps/default/immich/app/microservices/helmrelease.yaml b/kubernetes/apps/default/immich/app/microservices/helmrelease.yaml
index d765ca329..d8faba7ef 100644
--- a/kubernetes/apps/default/immich/app/microservices/helmrelease.yaml
+++ b/kubernetes/apps/default/immich/app/microservices/helmrelease.yaml
@@ -29,8 +29,6 @@ spec:
     keepHistory: false
   dependsOn:
     - name: immich-server
-    - name: redis
-      namespace: database
   values:
     defaultPodOptions:
       enableServiceLinks: false
@@ -74,6 +72,22 @@ spec:
               limits:
                 gpu.intel.com/i915: 1
                 memory: 6000Mi
+        pod:
+          enableServiceLinks: false
+          securityContext:
+            runAsUser: 568
+            runAsGroup: 568
+            fsGroup: 568
+            fsGroupChangePolicy: OnRootMismatch
+          topologySpreadConstraints:
+            - maxSkew: 1
+              topologyKey: kubernetes.io/hostname
+              whenUnsatisfiable: DoNotSchedule
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: *app
+          nodeSelector:
+            intel.feature.node.kubernetes.io/gpu: "true"
     service:
       main:
         enabled: false
diff --git a/kubernetes/apps/default/immich/app/server/helmrelease.yaml b/kubernetes/apps/default/immich/app/server/helmrelease.yaml
index 81c5f1844..ae93ce70c 100644
--- a/kubernetes/apps/default/immich/app/server/helmrelease.yaml
+++ b/kubernetes/apps/default/immich/app/server/helmrelease.yaml
@@ -78,6 +78,23 @@ spec:
               requests:
                 cpu: 100m
                 memory: 250Mi
+              limits:
+                memory: 1000Mi
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /server-info/ping
+                    port: 3001
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
     service:
       main:
         ports: