diff --git a/machines/magenta/services/traefik.nix b/machines/magenta/services/traefik.nix
index 26571c5..ff48fd4 100644
--- a/machines/magenta/services/traefik.nix
+++ b/machines/magenta/services/traefik.nix
@@ -80,6 +80,10 @@ in
         "${mirrorVolume dynamicConfigFile}:ro"
         "${mirrorVolume config.age.secrets.traefik-dashboard-basicauth-users.path}:ro"
       ];
+      deploy = {
+        placement.constraints = [ "node.role==manager" ];
+        update_config.order = "start-first";
+      };
     };
   };
 
diff --git a/machines/modules/docker-stack.nix b/machines/modules/docker-stack.nix
index 540f9a8..f355e44 100644
--- a/machines/modules/docker-stack.nix
+++ b/machines/modules/docker-stack.nix
@@ -96,6 +96,31 @@ let
           ]
         '';
       };
+
+      deploy = {
+        placement = {
+          constraints = mkOption {
+            default = [ ];
+            type = types.listOf types.str;
+            description = lib.mdDoc "";
+            example = [ "node.role==manager" ];
+          };
+        };
+        update_config = {
+          order = mkOption {
+            default = "stop-first";
+            type = types.str;
+            description = lib.mdDoc ''
+              Order of operations during updates.
+              - stop-first (old task is stopped before starting new one),
+              - start-first (new task is started first, and the running tasks briefly overlap) 
+
+              Note: Only supported for v3.4 and higher.
+            '';
+            example = "start-first";
+          };
+        };
+      };
     };
   };