diff --git a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
index 64eeb682..a14d97eb 100644
--- a/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-account-controller.yaml
@@ -102,6 +102,7 @@ rules:
     resourceNames:
       - mqtt-test-cert-tls
       - mqtt-mosquitto-probe-tls
+      - mqtt-zigbee2mqtt-bridge-tls
     verbs: ["delete"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
diff --git a/kubernetes/apps/home-assistant/mqtt-accounts.yaml b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
index 82b4bf14..bb2324d1 100644
--- a/kubernetes/apps/home-assistant/mqtt-accounts.yaml
+++ b/kubernetes/apps/home-assistant/mqtt-accounts.yaml
@@ -26,3 +26,11 @@
   auth: cert
   deliver: {namespace: home-assistant}
   acl: ["readwrite health/#"]
+# Zigbee2MQTT and its two sidecars (discovery-guard, interview-watch), one
+# certificate for the pod. Same ACL as the legacy user `zigbee2mqtt`; not
+# named like it, so this entry cannot shadow the password login of a running
+# Z2M (REN-953).
+- name: zigbee2mqtt-bridge
+  auth: cert
+  deliver: {namespace: home-assistant}
+  acl: ["readwrite zigbee2mqtt/#", "write homeassistant/#", "read homeassistant/status"]