diff --git a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
index b678f03e..d1d47ab5 100644
--- a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
@@ -252,7 +252,7 @@ spec:
         - name: controller
           # Woodpecker builds main-<sha> on every merge to main; no sortable
           # tag, so bumps are manual (same as ical-proxy).
-          image: gitea.renner.uno/konairius/mqtt-account-controller:main-a307693@sha256:4f58b900783148ad043201b1d787f0914e9c17ba011a88d23b6e68223b6bab74
+          image: gitea.renner.uno/konairius/mqtt-account-controller:main-1d03144@sha256:f0985f46254cbdf1ceb51fb72f2d6d098dbd236daa405a92efdbdeaefca71de9
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884
diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
index dc95841d..423b7a16 100644
--- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
@@ -138,6 +138,8 @@
 - name: shelly-2
   auth: password
   deliver: {shelly-manager: 2}  # Wall Display 00082266e106
+  # Checked but never rotated on "device not connected" (REN-1066).
+  rotate: false
   acl: ["readwrite shellies/#", "write homeassistant/#"]
 - name: shelly-26
   auth: password