diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d631bf..6f7a958 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# 0.4.1
+
+Module: `aws-ec2-vault-cluster` 0.4.1. No new AMI. A cluster that left `instance_type` unset rolls to the new size on its next apply.
+
+* Default `instance_type` is `t3.small`. Vault runs with mlock on and pins its binary in RAM; on a 1 GB `t3.micro` the kernel OOM-killed Vault about six minutes after boot, before bootstrap finished.
+
 # 0.4.0
 
 Module: `aws-ec2-vault-cluster` 0.4.0. Needs a fresh node AMI. The operator policy gains `sys/step-down` and `sys/storage/raft/remove-peer`; a cluster bootstrapped before this release must rewrite it with a break-glass root before the leave step works. A launch-template change rolls the nodes.
diff --git a/README.md b/README.md
index 33c708e..2b5654e 100644
--- a/README.md
+++ b/README.md
@@ -419,7 +419,7 @@ To plan against real connections:
 3. Run workspace preview/plan in Nullstone so `ns_connection` outputs resolve.
 4. In the plan, expect IAM, four Secrets Manager secrets (`init`, `provisioning`, `operator`, `apps-auth`; `protect_platform_secrets` default true, 30-day recovery), node and NLB security groups, a launch template, an ACM cert for `vault.internal`, an alias on the network internal zone, an internal NLB with TLS on 8200 (health 8210), and an ASG of `cluster_size` (`max_size` is `cluster_size + 1` for surge). A connected subdomain adds a user-facing cert (SNI) and alias. A launch-template change starts a rolling instance refresh: one extra node joins, then one old node leaves. Clients use output `vault_addr` (or `user_vault_addr`) with `tls_server_name`. The NLB terminates TLS only with a connected subdomain; Vault nodes listen HTTP.
 
-Bake the node AMI (x86_64, matches default `t3.micro`) from `vault-node/`:
+Bake the node AMI (x86_64, matches default `t3.small`) from `vault-node/`:
 
 ```bash
 GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o vault-node/vault-utils ./cmd/vault-utils
diff --git a/aws/aws-ec2-vault-cluster/README.md b/aws/aws-ec2-vault-cluster/README.md
index ba2238b..d28c093 100644
--- a/aws/aws-ec2-vault-cluster/README.md
+++ b/aws/aws-ec2-vault-cluster/README.md
@@ -16,7 +16,7 @@ Self-hosted Vault CE on an EC2 Auto Scaling Group: Raft storage, KMS auto-unseal
 | Name | Default | Purpose |
 |---|---|---|
 | `cluster_size` | `1` | Odd number of nodes |
-| `instance_type` | `t3.micro` | |
+| `instance_type` | `t3.small` | 2 GB floor; 1 GB is OOM-killed |
 | `ami`, `ami_owner` | latest `nullstone-vault` AMI from `522657839841` | Set `ami_owner = "self"` when this account bakes it |
 | `backup_schedule` | empty | Cron for S3 snapshots; empty disables |
 | `protect_platform_secrets` | `true` | `prevent_destroy` on the token secrets; set false before destroying the workspace |
diff --git a/aws/aws-ec2-vault-cluster/variables.tf b/aws/aws-ec2-vault-cluster/variables.tf
index 579f6b1..42e2e37 100644
--- a/aws/aws-ec2-vault-cluster/variables.tf
+++ b/aws/aws-ec2-vault-cluster/variables.tf
@@ -15,10 +15,11 @@ EOF
 
 variable "instance_type" {
   type        = string
-  default     = "t3.micro"
+  default     = "t3.small"
   description = <<EOF
 Instance Type that dictates CPU, Memory, network bandwidth, and file storage type and bandwidth.
 See https://aws.amazon.com/ec2/instance-types/ for EC2 instance types.
+Vault locks its binary in memory; 2 GB is the floor. A 1 GB instance is OOM-killed a few minutes after boot.
 EOF
 }