diff --git a/kubernetes/seed/influxdb/ha-token-job.yaml b/kubernetes/seed/influxdb/ha-token-job.yaml
index 3528ecbb..8e41b378 100644
--- a/kubernetes/seed/influxdb/ha-token-job.yaml
+++ b/kubernetes/seed/influxdb/ha-token-job.yaml
@@ -29,10 +29,17 @@ metadata:
   name: ha-influxdb-token-writer
   namespace: home-assistant
 rules:
+  # `create` cannot be combined with resourceNames — the resource
+  # doesn't exist yet at creation time. Split into two rules: blanket
+  # `create` on Secrets in the namespace, then resourceNames-restricted
+  # `get/update/patch` on the single token Secret.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create"]
   - apiGroups: [""]
     resources: ["secrets"]
     resourceNames: ["ha-influxdb-token"]
-    verbs: ["get", "create", "update", "patch"]
+    verbs: ["get", "update", "patch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding