diff --git a/modules/aws/eks-addons/main.tf b/modules/aws/eks-addons/main.tf
index 076b417..4bd41bd 100644
--- a/modules/aws/eks-addons/main.tf
+++ b/modules/aws/eks-addons/main.tf
@@ -111,19 +111,49 @@ resource "aws_eks_addon" "ebs_csi" {
   tags = var.tags
 }
 
-# Set gp3 (EBS CSI) as default StorageClass and enable volume expansion.
-resource "terraform_data" "gp3_default_storageclass" {
+# gp3 StorageClass using EBS CSI driver (replaces in-tree gp2)
+resource "kubectl_manifest" "gp3_storageclass" {
+  yaml_body = yamlencode({
+    apiVersion = "storage.k8s.io/v1"
+    kind       = "StorageClass"
+    metadata = {
+      name = "gp3"
+      annotations = {
+        "storageclass.kubernetes.io/is-default-class" = "true"
+      }
+    }
+    provisioner          = "ebs.csi.aws.com"
+    parameters = {
+      type   = "gp3"
+      fsType = "ext4"
+    }
+    reclaimPolicy        = "Delete"
+    volumeBindingMode    = "WaitForFirstConsumer"
+    allowVolumeExpansion = true
+  })
+
   depends_on = [aws_eks_addon.ebs_csi]
+}
 
-  provisioner "local-exec" {
-    command = <<-EOT
-      kubectl patch storageclass gp3 -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}' --type=merge
-      kubectl patch storageclass gp3 -p '{"allowVolumeExpansion":true}' --type=merge
-      kubectl patch storageclass gp3 -p '{"reclaimPolicy":"Delete"}' --type=merge
-      kubectl patch storageclass gp2 -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":null}}}' --type=merge 2>/dev/null || true
-    EOT
-  }
+# Remove default annotation from the legacy in-tree gp2 storage class
+resource "kubectl_manifest" "gp2_remove_default" {
+  yaml_body = yamlencode({
+    apiVersion = "storage.k8s.io/v1"
+    kind       = "StorageClass"
+    metadata = {
+      name = "gp2"
+      annotations = {
+        "storageclass.kubernetes.io/is-default-class" = "false"
+      }
+    }
+    provisioner       = "kubernetes.io/aws-ebs"
+    reclaimPolicy     = "Delete"
+    volumeBindingMode = "WaitForFirstConsumer"
+  })
+
+  depends_on = [kubectl_manifest.gp3_storageclass]
 
-  # Re-run when inputs change (triggers replace)
-  input = "gp3-default"
+  lifecycle {
+    ignore_changes = [yaml_body]
+  }
 }