diff --git a/kubernetes/apps/home-assistant/kustomization.yaml b/kubernetes/apps/home-assistant/kustomization.yaml
index 4d884e06..ce5aa9a1 100644
--- a/kubernetes/apps/home-assistant/kustomization.yaml
+++ b/kubernetes/apps/home-assistant/kustomization.yaml
@@ -16,6 +16,8 @@ resources:
   # probes use the cert account mosquitto-probe, REN-953); removed with its
   # rotator in the REN-802 cleanup step.
   - mosquitto-health-credentials-externalsecret.yaml
+  # Temporary: adopt-then-prune of the orphaned shellies Secret (REN-1256).
+  - mosquitto-shellies-credentials-adopt.yaml
   - mosquitto-config.yaml
   - mosquitto-certificate.yaml
   - mosquitto-service.yaml
diff --git a/kubernetes/apps/home-assistant/mosquitto-shellies-credentials-adopt.yaml b/kubernetes/apps/home-assistant/mosquitto-shellies-credentials-adopt.yaml
new file mode 100644
index 00000000..548f1405
--- /dev/null
+++ b/kubernetes/apps/home-assistant/mosquitto-shellies-credentials-adopt.yaml
@@ -0,0 +1,10 @@
+# Adopt-then-prune (REN-1256, REN-1236 step 1). The removed shellies bootstrap
+# Job created this Secret outside Git; the broker no longer reads it. Listing
+# it here with no data puts it in the Flux inventory; the follow-up PR removes
+# this file so prune deletes the Secret. Remove this file in that PR.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mosquitto-shellies-credentials
+  namespace: home-assistant
+type: Opaque