diff --git a/kubernetes/apps/home-assistant/kustomization.yaml b/kubernetes/apps/home-assistant/kustomization.yaml
index 2f434c58..706de8ba 100644
--- a/kubernetes/apps/home-assistant/kustomization.yaml
+++ b/kubernetes/apps/home-assistant/kustomization.yaml
@@ -24,6 +24,7 @@ resources:
   - shelly-manager-firmware-rbac.yaml
   - shelly-ble-proxy-key-externalsecret.yaml
   - shelly-manager-auth-externalsecret.yaml
+  - shelly-manager-llat-externalsecret.yaml
   - shelly-manager-deployment.yaml
   - shelly-manager-service.yaml
   - shelly-manager-gate-service.yaml
diff --git a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
index 3215e7cd..3db8b287 100644
--- a/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
+++ b/kubernetes/apps/home-assistant/shelly-manager-deployment.yaml
@@ -118,6 +118,20 @@ spec:
               value: X-authentik-username
             - name: Auth__ReverseProxy__TrustedProxies__0
               value: 10.244.0.0/16
+            # Home Assistant onboarding: single-click provisioning also registers
+            # the device in HA's native Shelly integration (with the admin
+            # password shelly-manager set) by driving HA's config-flow + device-
+            # registry WS API. BaseUrl is the in-namespace HA service (:80 → the
+            # nginx sidecar → HA :8123; nginx forwards the websocket upgrade, so
+            # both the config-flow REST and the device-registry WS work). Token is
+            # a full-admin HA LLAT from OpenBao (apps/home-assistant/shelly-manager-llat).
+            - name: HomeAssistant__BaseUrl
+              value: http://home-assistant
+            - name: HomeAssistant__Token
+              valueFrom:
+                secretKeyRef:
+                  name: shelly-manager-llat
+                  key: token
           volumeMounts:
             - name: data
               mountPath: /data
diff --git a/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml b/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml
new file mode 100644
index 00000000..e08a4312
--- /dev/null
+++ b/kubernetes/apps/home-assistant/shelly-manager-llat-externalsecret.yaml
@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: shelly-manager-llat
+  namespace: home-assistant
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: shelly-manager-llat
+  # A Home Assistant admin long-lived access token. HA has no fine-grained
+  # tokens, so this is full-admin — shelly-manager uses it only to drive the
+  # config-flow API (create/verify/delete the Shelly entries it provisions).
+  dataFrom:
+    - extract:
+        key: apps/home-assistant/shelly-manager-llat