diff --git a/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml
new file mode 100644
index 0000000000..2c4ff8a80a
--- /dev/null
+++ b/k8s/providers/hetzner/infrastructure/controllers/cilium/patches/require-relay-node-spread.yaml
@@ -0,0 +1,22 @@
+---
+# The base's soft spread permits both replicas on one node. Production has
+# multiple eligible nodes and needs separate failure domains (#5576).
+# Keep this in the provider overlay so a one-node local cluster still works.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: kube-system
+spec:
+  values:
+    hubble:
+      relay:
+        topologySpreadConstraints:
+          - maxSkew: 1
+            # A single remaining node must not become two replicas' failure domain.
+            minDomains: 2
+            topologyKey: kubernetes.io/hostname
+            whenUnsatisfiable: DoNotSchedule
+            labelSelector:
+              matchLabels:
+                k8s-app: hubble-relay
diff --git a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml
index 536378384e..f1899b3474 100644
--- a/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml
+++ b/k8s/providers/hetzner/infrastructure/controllers/kustomization.yaml
@@ -139,6 +139,8 @@ patches:
   - path: kyverno/patches/enable-user-namespaces.yaml
   # Prod-only fail-closed WireGuard encryption (egress strict mode) — see file.
   - path: cilium/patches/enforce-wireguard-strict-mode.yaml
+  # Require relay replicas to use separate nodes in prod; local retains soft spread.
+  - path: cilium/patches/require-relay-node-spread.yaml
   # Dormant prod-only SPIRE storage values. Authentication/SPIRE stay disabled
   # until a narrow policy consumer lands; if re-enabled, keep the datastore off
   # Longhorn to avoid the SPIRE <-> Longhorn <-> mTLS cycle — see file.
diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt
index 2e422cf0b2..9968925216 100644
--- a/scripts/validate-eks-ci-role-policy/approved-surface.txt
+++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt
@@ -52,7 +52,7 @@ helm.toolkit.fluxcd.io/v2|HelmRelease|kro-system|kro cd7531d09eab1fa5898b2069fef
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|ksail-operator|ksail-operator dfc2fd679b30a0acf35fcddc41eb883980c345036c95b3ebc5a9d21e0354bfa9
 
-helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 6d236fa5fb605763ece34cb062940f58e636f3a2c593047ad1ab0d6a489e7df5
+helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|cilium 583656039a7b6f65fab253ef1ce6ea63ffffd4437e404d5d42996208143a3c7a
 
 helm.toolkit.fluxcd.io/v2|HelmRelease|kube-system|descheduler 40d41e62d48b7db3706d544a94b25a75e497d7f11ca6efec1376774c8085de13