diff --git a/matrix-synapse/Chart.yaml b/matrix-synapse/Chart.yaml
index 7af98eb..db86dbf 100644
--- a/matrix-synapse/Chart.yaml
+++ b/matrix-synapse/Chart.yaml
@@ -3,7 +3,7 @@ name: matrix-synapse
 description: A Helm chart to deploy a Matrix Synapse server on Kubernetes
 icon: https://raw.githubusercontent.com/element-hq/synapse/develop/docs/favicon.png
 type: application
-version: 5.0.0+upv1.159.0
+version: 6.0.0+upv1.159.0
 appVersion: "v1.159.0"
 maintainers:
   - name: jklein
\ No newline at end of file
diff --git a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
index 3934c0c..14f62f8 100644
--- a/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
+++ b/matrix-synapse/templates/matrix-delegation-nginx.deployment.yaml
@@ -14,6 +14,13 @@ spec:
     metadata:
       labels:
         app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
+      annotations:
+        # Hash of the rendered delegation ConfigMap: a changed nginx.conf
+        # changes the pod template and thus rolls the pods. Without it the
+        # running nginx keeps serving the old .well-known documents - the
+        # config is mounted with subPath (never refreshed by the kubelet) and
+        # nginx reads it only at start.
+        checksum/config: {{ include (print $.Template.BasePath "/matrix-delegation-nginx.configmap.yaml") . | sha256sum }}
     spec:
       automountServiceAccountToken: false
       securityContext:
diff --git a/matrix-synapse/values.yaml b/matrix-synapse/values.yaml
index 0375764..bc5c00f 100644
--- a/matrix-synapse/values.yaml
+++ b/matrix-synapse/values.yaml
@@ -5,6 +5,18 @@
 scaleDown: false
 
 secrets:
+  # homeserver.yaml is mounted into the Synapse StatefulSet from the Secret the
+  # 1Password operator materializes from this item.
+  #
+  # Known limitation (#82): a change to the item in the vault does NOT restart
+  # Synapse. Helm cannot hash the content (it never sees it - the operator fills
+  # the Secret in-cluster after rendering), so the checksum/config mechanism the
+  # delegation nginx uses does not apply here. The operator's own
+  # "operator.1password.io/auto-restart" annotation is no help either: it only
+  # ever restarts Deployments, and this workload is a StatefulSet (verified
+  # against onepassword-operator 1.12.0). After changing the item, restart
+  # Synapse by hand:
+  #   kubectl rollout restart statefulset <release>-matrix-synapse-sfs
   configSecretRef: null
 
 matrix: