diff --git a/tasks/main.yml b/tasks/main.yml
index f4f2e54..ff37aef 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -273,5 +273,17 @@
 
       tolerations: []
 
-      affinity: {}
+      # Keep heavy apps off the 1-CPU node that hosts ingress-nginx; sharing it
+      # starved Nextcloud and risks the ingress / MetalLB announcement.
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: ingress-nginx
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: controller
+                  app.kubernetes.io/name: ingress-nginx