diff --git a/apps/guacamole/guacamole.yaml b/apps/guacamole/guacamole.yaml
index 569ec68..a3ccccb 100644
--- a/apps/guacamole/guacamole.yaml
+++ b/apps/guacamole/guacamole.yaml
@@ -177,6 +177,13 @@ spec:
         app: guacd
     spec:
       serviceAccountName: guacd-exec
+      # Pinned to rke2-agent2: Synology NFS export at /volume1/kubernetes
+      # currently grants mount permission only to 10.0.56.13. guacd + guacamole
+      # web share the NFS-backed /var/lib/guacamole/recordings, so co-locating
+      # is also efficient. Remove this when the Synology NFS ACL opens to all
+      # cluster nodes.
+      nodeSelector:
+        kubernetes.io/hostname: rke2-agent2
       containers:
         - name: guacd
           image: guacamole/guacd:latest
@@ -256,6 +263,9 @@ spec:
       labels:
         app: guacamole
     spec:
+      # Pinned to rke2-agent2: same reason as guacd (NFS recordings mount).
+      nodeSelector:
+        kubernetes.io/hostname: rke2-agent2
       containers:
         - name: guacamole
           image: guacamole/guacamole:latest