diff --git a/kubernetes/apps/home-assistant/deployment.yaml b/kubernetes/apps/home-assistant/deployment.yaml
index 326f09c1..643cfee4 100644
--- a/kubernetes/apps/home-assistant/deployment.yaml
+++ b/kubernetes/apps/home-assistant/deployment.yaml
@@ -430,44 +430,26 @@ spec:
                   fi
                 fi
 
-                # InfluxDB recorder reconcile. Top-level `influxdb:`
-                # block in configuration.yaml gets repointed at the
-                # in-cluster InfluxDB. Skipped when INFLUX_TOKEN is
-                # empty (Job in influxdb namespace hasn't populated
-                # the cross-namespace Secret yet). Once the token
-                # appears, the next loop iteration patches and
-                # self-deletes the pod for a clean rollover. Only the
-                # connection+auth keys are touched; HA-managed
-                # include/exclude/tags filters are left intact.
+                # InfluxDB integration (HACS / UI-config; stored in
+                # core.config_entries with domain "influxdb"). Repoint
+                # the legacy http://influxdb.srv.renner.uno:8086 URL +
+                # legacy write-bucket token at the in-cluster
+                # InfluxDB. Token comes from the ha-influxdb-token
+                # Secret created cross-namespace by the
+                # influxdb-ha-token Job; skipped when INFLUX_TOKEN is
+                # empty (Secret not yet populated). Shallow-merge via
+                # reconcile_entry preserves any HA-managed fields
+                # (e.g. ssl_ca_cert).
                 if [ -n "${INFLUX_TOKEN:-}" ]; then
-                  desired_influx=$(jq -ncS \
-                    --arg token "$INFLUX_TOKEN" \
-                    '{api_version: 2,
-                      host: "influxdb-influxdb2.influxdb.svc.cluster.local",
-                      port: 8086,
-                      ssl: false,
-                      verify_ssl: false,
-                      organization: "renner",
-                      bucket: "suedstr28",
-                      token: $token}')
-                  current_influx=$(yq -o=json '.influxdb // {}' "$CONFIG" 2>/dev/null \
-                    | jq -cS --argjson d "$desired_influx" \
-                        'with_entries(select(.key as $k | $d | has($k)))' \
-                    || echo '{}')
-                  if [ "$desired_influx" != "$current_influx" ]; then
-                    echo "influxdb config drift; patching"
-                    yq -i '
-                      .influxdb.api_version = 2 |
-                      .influxdb.host = "influxdb-influxdb2.influxdb.svc.cluster.local" |
-                      .influxdb.port = 8086 |
-                      .influxdb.ssl = false |
-                      .influxdb.verify_ssl = false |
-                      .influxdb.organization = "renner" |
-                      .influxdb.bucket = "suedstr28" |
-                      .influxdb.token = strenv(INFLUX_TOKEN)
-                    ' "$CONFIG"
-                    drift=1
-                  fi
+                  reconcile_entry '.domain=="influxdb"' \
+                    "$(jq -ncS --arg t "$INFLUX_TOKEN" '{
+                        url: "http://influxdb-influxdb2.influxdb.svc.cluster.local:8086",
+                        token: $t,
+                        bucket: "suedstr28",
+                        organization: "renner",
+                        api_version: "2",
+                        verify_ssl: false}')" \
+                    "influxdb"
                 fi
 
                 # Sibling-app integrations: HAOS supervisor addon names