diff --git a/kubernetes/apps/home-assistant/sml2mqtt-config.yaml b/kubernetes/apps/home-assistant/sml2mqtt-config.yaml
index 60a932cc..ae201af5 100644
--- a/kubernetes/apps/home-assistant/sml2mqtt-config.yaml
+++ b/kubernetes/apps/home-assistant/sml2mqtt-config.yaml
@@ -17,7 +17,7 @@ data:
   config.yml: |
     logging:
       level: INFO
-      file: ''            # stdout -> kubectl logs / Loki
+      file: stdout        # 'stdout' -> kubectl logs / Loki (NOT '' — that opens the dir)
 
     mqtt:
       connection:
diff --git a/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml b/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml
index a3930c3d..f14e5998 100644
--- a/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml
+++ b/kubernetes/apps/home-assistant/sml2mqtt-deployment.yaml
@@ -10,10 +10,9 @@
 #
 # SERIAL EXCLUSIVITY: the meter's /dev/ttyUSB0 is a single serial stream;
 # edl21 (in the HA pod) and sml2mqtt cannot both read it without
-# corrupting each other's SML framing. Therefore this Deployment ships at
-# `replicas: 0` (dormant). The cutover is: disable edl21 in HA -> scale
-# this to 1 -> add HA MQTT sensors -> evict HA from edge. Until then,
-# merging this changes nothing at runtime.
+# corrupting each other's SML framing. edl21 has now been disabled in HA,
+# freeing the port, so this is activated (replicas: 1). Remaining cutover:
+# add HA MQTT sensors reusing the old entity_ids -> evict HA from edge.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -22,8 +21,7 @@ metadata:
   labels:
     app.kubernetes.io/name: sml2mqtt
 spec:
-  # Dormant until the edl21 -> MQTT cutover frees the serial port. See header.
-  replicas: 0
+  replicas: 1
   strategy:
     type: Recreate
   selector:
@@ -82,9 +80,13 @@ spec:
             - name: stromzaehler
               mountPath: /dev/stromzaehler
           securityContext:
-            # The meter device is root:root 0600 on the node, so the
-            # process must run as root to open it. No `privileged` needed —
-            # owner-root + the hostPath device mount is sufficient.
+            # The meter device is root:root 0600 on the node. Opening it
+            # needs BOTH: runAsUser 0 (file DAC) AND privileged (the device
+            # cgroup blocks a hostPath-mounted char device for non-privileged
+            # containers even as root — there's no device-plugin here). This
+            # mirrors how the HA pod accesses the same device today; the win
+            # is that it's now a tiny pod instead of the 8Gi HA pod.
+            privileged: true
             runAsUser: 0
             runAsGroup: 0
           resources: