diff --git a/src/production/adminer/compose.yaml b/src/production/adminer/compose.yaml
index cbe52b06..c471fc93 100644
--- a/src/production/adminer/compose.yaml
+++ b/src/production/adminer/compose.yaml
@@ -4,3 +4,5 @@ services:
       labels:
         - (( append ))
         - traefik.http.routers.adminer-secure.tls.certresolver=default
+      update_config:
+        order: start-first
diff --git a/src/production/cloudflared/compose.yaml b/src/production/cloudflared/compose.yaml
index 9fddd7ed..478bc395 100644
--- a/src/production/cloudflared/compose.yaml
+++ b/src/production/cloudflared/compose.yaml
@@ -5,6 +5,8 @@ services:
     deploy:
       labels:
         - dargstack.profiles=default
+      update_config:
+        order: start-first
     environment:
       TUNNEL_TOKEN: ${CLOUDFLARED_TUNNEL_TOKEN}
     image: cloudflare/cloudflared
diff --git a/src/production/debezium/compose.yaml b/src/production/debezium/compose.yaml
new file mode 100644
index 00000000..484d03e5
--- /dev/null
+++ b/src/production/debezium/compose.yaml
@@ -0,0 +1,9 @@
+services:
+  debezium:
+    deploy:
+      update_config:
+        order: stop-first
+  debezium-postgres-connector:
+    deploy:
+      update_config:
+        order: stop-first
diff --git a/src/production/elasticsearch/compose.yaml b/src/production/elasticsearch/compose.yaml
new file mode 100644
index 00000000..b48924b3
--- /dev/null
+++ b/src/production/elasticsearch/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  elasticsearch:
+    deploy:
+      update_config:
+        order: stop-first
diff --git a/src/production/geoip/compose.yaml b/src/production/geoip/compose.yaml
new file mode 100644
index 00000000..fc5fc9a9
--- /dev/null
+++ b/src/production/geoip/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  geoip:
+    deploy:
+      update_config:
+        order: start-first
diff --git a/src/production/grafana/compose.yaml b/src/production/grafana/compose.yaml
index 703cdaa0..b28ce288 100644
--- a/src/production/grafana/compose.yaml
+++ b/src/production/grafana/compose.yaml
@@ -4,3 +4,5 @@ services:
       labels:
         - (( append ))
         - traefik.http.routers.grafana-secure.tls.certresolver=default
+      update_config:
+        order: start-first
diff --git a/src/production/jobber/compose.yaml b/src/production/jobber/compose.yaml
index df5db9ff..063fbc2f 100644
--- a/src/production/jobber/compose.yaml
+++ b/src/production/jobber/compose.yaml
@@ -1,5 +1,8 @@
 services:
   jobber:
+    deploy:
+      update_config:
+        order: stop-first
     environment:
       SENTRY_CRONS: ${SENTRY_CRONS}
     volumes:
diff --git a/src/production/memcached/compose.yaml b/src/production/memcached/compose.yaml
new file mode 100644
index 00000000..c448c776
--- /dev/null
+++ b/src/production/memcached/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  memcached:
+    deploy:
+      update_config:
+        order: start-first
diff --git a/src/production/portainer-agent/compose.yaml b/src/production/portainer-agent/compose.yaml
new file mode 100644
index 00000000..601a15a3
--- /dev/null
+++ b/src/production/portainer-agent/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  portainer-agent:
+    deploy:
+      update_config:
+        order: start-first
diff --git a/src/production/portainer/compose.yaml b/src/production/portainer/compose.yaml
index 4d42fef0..d443dc3b 100644
--- a/src/production/portainer/compose.yaml
+++ b/src/production/portainer/compose.yaml
@@ -4,3 +4,5 @@ services:
       labels:
         - (( append ))
         - traefik.http.routers.portainer-secure.tls.certresolver=default
+      update_config:
+        order: stop-first
diff --git a/src/production/postgraphile/compose.yaml b/src/production/postgraphile/compose.yaml
index 5af8367f..53bd2eff 100644
--- a/src/production/postgraphile/compose.yaml
+++ b/src/production/postgraphile/compose.yaml
@@ -5,4 +5,6 @@ services:
         - (( append ))
         - traefik.http.routers.postgraphile.middlewares=postgraphile-auth,postgraphile-cors
         - traefik.http.routers.postgraphile-secure.tls.certresolver=default
+      update_config:
+        order: start-first
     image: ghcr.io/maevsi/postgraphile:2.0.0-beta.1
diff --git a/src/production/postgres/compose.yaml b/src/production/postgres/compose.yaml
index a85f6aad..daeab7be 100644
--- a/src/production/postgres/compose.yaml
+++ b/src/production/postgres/compose.yaml
@@ -3,8 +3,15 @@ secrets:
     # The database's name.
     external: true
 services:
+  postgres:
+    deploy:
+      update_config:
+        order: stop-first
   postgres-backup:
     # You cannot access the database backup directly.
+    deploy:
+      update_config:
+        order: stop-first
     environment:
       POSTGRES_DB_FILE: /run/secrets/postgres-backup-db
       POSTGRES_HOST: postgres
diff --git a/src/production/prometheus/compose.yaml b/src/production/prometheus/compose.yaml
index f899c1f5..502d2ee7 100644
--- a/src/production/prometheus/compose.yaml
+++ b/src/production/prometheus/compose.yaml
@@ -4,3 +4,5 @@ services:
       labels:
         - (( append ))
         - traefik.http.routers.prometheus-secure.tls.certresolver=default
+      update_config:
+        order: stop-first
diff --git a/src/production/reccoom/compose.yaml b/src/production/reccoom/compose.yaml
index 2c24a269..9d1f9efa 100644
--- a/src/production/reccoom/compose.yaml
+++ b/src/production/reccoom/compose.yaml
@@ -1,4 +1,7 @@
 services:
   reccoom:
-    deploy: (( prune ))
+    deploy:
+      labels: (( prune ))
+      update_config:
+        order: start-first
     image: ghcr.io/maevsi/reccoom:0.9.0
diff --git a/src/production/reccoom_postgres/compose.yaml b/src/production/reccoom_postgres/compose.yaml
new file mode 100644
index 00000000..1af6917d
--- /dev/null
+++ b/src/production/reccoom_postgres/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  reccoom_postgres:
+    deploy:
+      update_config:
+        order: stop-first
diff --git a/src/production/redis/compose.yaml b/src/production/redis/compose.yaml
new file mode 100644
index 00000000..2220d16c
--- /dev/null
+++ b/src/production/redis/compose.yaml
@@ -0,0 +1,5 @@
+services:
+  redis:
+    deploy:
+      update_config:
+        order: stop-first
diff --git a/src/production/redpanda/compose.yaml b/src/production/redpanda/compose.yaml
index 224787c6..8d384353 100644
--- a/src/production/redpanda/compose.yaml
+++ b/src/production/redpanda/compose.yaml
@@ -1,6 +1,12 @@
 services:
+  redpanda:
+    deploy:
+      update_config:
+        order: stop-first
   redpanda-console:
     deploy:
       labels:
         - (( append ))
         - traefik.http.routers.redpanda-secure.tls.certresolver=default
+      update_config:
+        order: start-first
diff --git a/src/production/sqitch/compose.yaml b/src/production/sqitch/compose.yaml
index ebc452fb..bba237f2 100644
--- a/src/production/sqitch/compose.yaml
+++ b/src/production/sqitch/compose.yaml
@@ -1,4 +1,7 @@
 services:
   sqitch:
+    deploy:
+      update_config:
+        order: stop-first
     image: ghcr.io/maevsi/sqitch:10.0.8
     volumes: (( prune ))
diff --git a/src/production/traefik/compose.yaml b/src/production/traefik/compose.yaml
index a7f41d9c..ba98faf7 100644
--- a/src/production/traefik/compose.yaml
+++ b/src/production/traefik/compose.yaml
@@ -16,6 +16,8 @@ services:
       labels:
         - (( append ))
         - traefik.http.routers.traefik-secure.tls.certresolver=default
+      update_config:
+        order: start-first
     environment:
       CF_DNS_API_TOKEN_FILE: /run/secrets/traefik-cf-dns-api-token
       CF_ZONE_API_TOKEN_FILE: /run/secrets/traefik-cf-zone-api-token
@@ -33,6 +35,9 @@ services:
       - --source=/etc/traefik/acme/acme.json
       - --version=v2
       - --watch
+    deploy:
+      update_config:
+        order: stop-first
     environment:
       STACK_DOMAIN: ${STACK_DOMAIN}
     image: ldez/traefik-certs-dumper:v2.11.0
diff --git a/src/production/tusd/compose.yaml b/src/production/tusd/compose.yaml
index 6e97d0cc..54e38bba 100644
--- a/src/production/tusd/compose.yaml
+++ b/src/production/tusd/compose.yaml
@@ -5,3 +5,5 @@ services:
         - (( append ))
         - traefik.http.routers.tusd.middlewares=tusd-cors
         - traefik.http.routers.tusd-secure.tls.certresolver=default
+      update_config:
+        order: start-first
diff --git a/src/production/vibetype/compose.yaml b/src/production/vibetype/compose.yaml
index 19559704..2c28e437 100644
--- a/src/production/vibetype/compose.yaml
+++ b/src/production/vibetype/compose.yaml
@@ -5,6 +5,8 @@ services:
         - (( append ))
         - traefik.http.routers.vibetype.middlewares=vibetype_cors,vibetype_redirectregex
         - traefik.http.routers.vibetype-secure.tls.certresolver=default
+      update_config:
+        order: start-first
     image: ghcr.io/maevsi/vibetype:13.4.0
   # vibetype-beta:
   #   # You can access the main project frontend's beta version at [beta.app.localhost](https://beta.app.localhost/).
diff --git a/src/production/zammad/compose.yaml b/src/production/zammad/compose.yaml
index 60f892ef..e610980c 100644
--- a/src/production/zammad/compose.yaml
+++ b/src/production/zammad/compose.yaml
@@ -1,6 +1,28 @@
 services:
+  zammad-backup:
+    deploy:
+      update_config:
+        order: stop-first
+  zammad-init:
+    deploy:
+      update_config:
+        order: stop-first
   zammad-nginx:
     deploy:
       labels:
         - (( append ))
         - traefik.http.routers.zammad-secure.tls.certresolver=default
+      update_config:
+        order: start-first
+  zammad-railsserver:
+    deploy:
+      update_config:
+        order: start-first
+  zammad-scheduler:
+    deploy:
+      update_config:
+        order: stop-first
+  zammad-websocket:
+    deploy:
+      update_config:
+        order: start-first