diff --git a/k8s/platform/logging/grafana-values.yaml b/k8s/platform/logging/grafana-values.yaml
index 70c2af1..634fa2f 100644
--- a/k8s/platform/logging/grafana-values.yaml
+++ b/k8s/platform/logging/grafana-values.yaml
@@ -157,6 +157,18 @@ tolerations:
     operator: Exists
     effect: NoSchedule
 
+# Pin to az-a (talos-cp-1) — the only node running Longhorn. Without this the
+# scheduler may place grafana on cp-2/cp-3, where its Longhorn PVC cannot attach
+# ("CSINode does not contain driver driver.longhorn.io").
+affinity:
+  nodeAffinity:
+    requiredDuringSchedulingIgnoredDuringExecution:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: topology.kubernetes.io/zone
+              operator: In
+              values: [az-a]
+
 # ClusterIP only — access via ingress (grafana.riotpiao.com) or port-forward.
 service:
   type: ClusterIP
diff --git a/k8s/platform/logging/loki-values.yaml b/k8s/platform/logging/loki-values.yaml
index 94b5941..b404094 100644
--- a/k8s/platform/logging/loki-values.yaml
+++ b/k8s/platform/logging/loki-values.yaml
@@ -134,6 +134,11 @@ singleBinary:
     storageClassName: longhorn
     size: 5Gi
 
+  # Pin to az-a (talos-cp-1) — sole Longhorn node; otherwise the PVC fails to
+  # attach on cp-2/cp-3.
+  nodeSelector:
+    topology.kubernetes.io/zone: az-a
+
 # ── Disable micro-service replicas ───────────────────────────────────────────
 # In SingleBinary mode the chart still templates read/write/backend Deployments
 # unless explicitly set to 0. Setting replicas: 0 keeps them out of the cluster.