diff --git a/kubernetes/apps/home-assistant/mosquitto-deployment.yaml b/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
index e691c42e..88c4a0b4 100644
--- a/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
+++ b/kubernetes/apps/home-assistant/mosquitto-deployment.yaml
@@ -44,16 +44,21 @@ spec:
               mosquitto_passwd -b /mosquitto/auth/passwd open3e "$OPEN3E_PASSWORD"
               mosquitto_passwd -b /mosquitto/auth/passwd evcc "$EVCC_PASSWORD"
               # ACL: HA keeps full access (subscribes to everything); the
-              # shellies user is scoped to `shellies/#` for device state +
-              # `homeassistant/#` so HA MQTT-discovery payloads from Shelly
-              # Gen2 firmwares are accepted. Tighten the discovery scope
-              # later if devices only publish under specific subtrees.
+              # shellies user is `readwrite shellies/#` (devices publish state
+              # and subscribe to their command topics) + `write homeassistant/#`
+              # so Shelly Gen2 firmwares can publish HA MQTT-discovery configs.
+              # It is WRITE-only on homeassistant/# on purpose: a publish-only
+              # client never needs to read the whole discovery/state tree, and
+              # denying read removes device-inventory recon for a compromised
+              # Shelly. (Full per-device write scoping isn't expressible with
+              # the flat discovery topic layout; that would need a dynamic-auth
+              # plugin — out of scope.)
               # `admin` is a workstation/debugging credential — full
               # readwrite, kept on its own credential so its password can
               # be rotated independently of the HA session.
-              # `sml2mqtt` is the power-meter bridge — publish-only under
-              # its own `sml2mqtt/#` subtree (HA reads it via the full-access
-              # homeassistant user).
+              # `sml2mqtt` is the power-meter bridge — WRITE-only under its own
+              # `sml2mqtt/#` subtree (it only publishes; HA reads it via the
+              # full-access homeassistant user).
               # `open3e` is the Viessmann E3 CAN bridge (Vitocal/VX3) —
               # scoped to its own `open3e/#` subtree: publishes datapoints
               # and later subscribes to `open3e/cmnd` in listener mode (HA
@@ -70,13 +75,13 @@ spec:
 
               user shellies
               topic readwrite shellies/#
-              topic readwrite homeassistant/#
+              topic write homeassistant/#
 
               user admin
               topic readwrite #
 
               user sml2mqtt
-              topic readwrite sml2mqtt/#
+              topic write sml2mqtt/#
 
               user open3e
               topic readwrite open3e/#