diff --git a/samba/Chart.yaml b/samba/Chart.yaml
index ccd8d23..309cf92 100644
--- a/samba/Chart.yaml
+++ b/samba/Chart.yaml
@@ -5,6 +5,6 @@ icon: https://avatars.githubusercontent.com/u/13281359
 
 type: application
 
-version: 4.0.0+up4.23.10
+version: 5.0.0+up4.23.10
 
 appVersion: 4.23.10
diff --git a/samba/templates/samba.sfs.yaml b/samba/templates/samba.sfs.yaml
index 54cf6bd..1efc3c4 100644
--- a/samba/templates/samba.sfs.yaml
+++ b/samba/templates/samba.sfs.yaml
@@ -15,6 +15,16 @@ spec:
       name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
+      annotations:
+        # Hash of the rendered ConfigMap: a changed smb.conf (i.e. a changed
+        # samba.shares list) changes the pod template and thus restarts the
+        # pod. Without it a new or renamed share never reaches the running
+        # smbd - smb.conf is mounted with subPath (never refreshed by the
+        # kubelet) and is read once at start.
+        # users.conf is NOT covered: it comes from a 1Password-backed Secret
+        # whose content Helm never sees. See secrets.sambaUsersSecretRef in
+        # values.yaml.
+        checksum/config: {{ include (print $.Template.BasePath "/samba-config.configmap.yaml") . | sha256sum }}
     spec:
       containers:
         - name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
diff --git a/samba/values.yaml b/samba/values.yaml
index 9476742..5ef358f 100644
--- a/samba/values.yaml
+++ b/samba/values.yaml
@@ -5,6 +5,19 @@
 scaleDown: false
 
 secrets:
+  # users.conf is mounted into the samba container from the Secret the 1Password
+  # operator materializes from this item.
+  #
+  # Known limitation (#82): changing the item in the vault does NOT restart
+  # samba, so added, removed or re-passworded users stay invisible to the
+  # running smbd. Helm cannot hash the content (it never sees it - the operator
+  # fills the Secret in-cluster after rendering), so the checksum/config
+  # mechanism used for smb.conf does not apply here. The operator's own
+  # "operator.1password.io/auto-restart" annotation is no help either: it only
+  # ever restarts Deployments, and this workload is a StatefulSet (verified
+  # against onepassword-operator 1.12.0). After changing the users item,
+  # restart samba by hand:
+  #   kubectl rollout restart statefulset <release>-samba-sfs
   sambaUsersSecretRef: null
 
 samba: