diff --git a/manifests/ate-install/atenet-dns.yaml b/manifests/ate-install/atenet-dns.yaml
index 46968a386..075117e2b 100644
--- a/manifests/ate-install/atenet-dns.yaml
+++ b/manifests/ate-install/atenet-dns.yaml
@@ -79,7 +79,11 @@ metadata:
   labels:
     app: dns
 spec:
-  replicas: 1
+  replicas: 2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
   selector:
     matchLabels:
       app: dns
@@ -89,6 +93,13 @@ spec:
         app: dns
     spec:
       serviceAccountName: atenet-dns
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app: dns
       shareProcessNamespace: true
       initContainers:
       - name: init-dns
@@ -112,6 +123,10 @@ spec:
       containers:
       - name: coredns
         image: coredns/coredns:1.11.1
+        lifecycle:
+          preStop:
+            sleep:
+              seconds: 5
         imagePullPolicy: IfNotPresent
         args: [ "-conf", "/etc/coredns/Corefile" ]
         volumeMounts:
@@ -173,4 +188,15 @@ spec:
     protocol: UDP
   - name: dns-tcp
     port: 53
-    protocol: TCP
\ No newline at end of file
+    protocol: TCP
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: dns
+  namespace: ate-system
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: dns
diff --git a/manifests/ate-install/atenet-router.yaml b/manifests/ate-install/atenet-router.yaml
index 9c8c9d7e0..4ce6fdcff 100644
--- a/manifests/ate-install/atenet-router.yaml
+++ b/manifests/ate-install/atenet-router.yaml
@@ -107,7 +107,11 @@ metadata:
   labels:
     app: atenet-router
 spec:
-  replicas: 1
+  replicas: 2
+  strategy:
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
   selector:
     matchLabels:
       app: atenet-router
@@ -120,6 +124,13 @@ spec:
         prometheus.io/port: "9090"
     spec:
       serviceAccountName: atenet-router
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app: atenet-router
       containers:
       - name: atenet-router
         image: ko://github.com/agent-substrate/substrate/cmd/atenet
@@ -172,6 +183,11 @@ spec:
         # Trust bundle used to verify ateapi's servicedns serving cert.
         - name: "servicedns-ca"
           mountPath: "/run/servicedns-ca"
+        # Keep ext_proc alive while the draining envoy still receives traffic.
+        lifecycle:
+          preStop:
+            sleep:
+              seconds: 5
       - name: envoy
         image: envoyproxy/envoy:v1.30-latest
         command:
@@ -187,6 +203,15 @@ spec:
           containerPort: 8443
         - name: admin
           containerPort: 9901
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: 9901
+          periodSeconds: 5
+        lifecycle:
+          preStop:
+            sleep:
+              seconds: 5
         volumeMounts:
         - name: envoy-config
           mountPath: /etc/envoy
@@ -257,3 +282,14 @@ spec:
     port: 4040
     targetPort: status
     protocol: TCP
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: atenet-router
+  namespace: ate-system
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels:
+      app: atenet-router