diff --git a/kubernetes/apps/home-assistant/config-sync.sh b/kubernetes/apps/home-assistant/config-sync.sh
index afea91c2..3d42224d 100644
--- a/kubernetes/apps/home-assistant/config-sync.sh
+++ b/kubernetes/apps/home-assistant/config-sync.sh
@@ -5,7 +5,9 @@
 # an RWO PVC. This loop force-syncs ONLY the HA YAML config paths from
 # origin/<branch> into the working tree, then calls homeassistant.reload_all so
 # the change goes live. It deliberately does NOT touch:
-#   - www/ (HACS rewrites those tracked files at runtime; leave them to HACS)
+#   - www/ in general (HACS rewrites those tracked files at runtime; leave them
+#     to HACS) — EXCEPT the few bespoke, non-HACS card files listed in PATHS,
+#     which are synced individually by exact path.
 #   - untracked runtime state (.storage/, *.db, secrets.yaml, tts/, deps/, ...)
 # Git auth uses the PAT already embedded in the PVC's remote URL; reload auth
 # uses the dedicated long-lived token in $HA_TOKEN.
@@ -20,8 +22,10 @@ INTERVAL="${SYNC_INTERVAL:-30}"
 HA_URL="${HA_URL:-http://127.0.0.1:8123}"
 
 # HA config paths to force-sync from origin/<branch>. Anything not listed here
-# (notably www/ and untracked runtime files) is left untouched.
-PATHS="automations.yaml automations packages scripts.yaml templates.yaml configuration.yaml notify.yaml groups.yaml powercalc.yaml blueprints"
+# (notably the rest of www/ and untracked runtime files) is left untouched.
+# www/heizungsanlage-card.js is a bespoke, non-HACS custom card, so it is synced
+# by exact path (the rest of www/ stays HACS-managed).
+PATHS="automations.yaml automations packages scripts.yaml templates.yaml configuration.yaml notify.yaml groups.yaml powercalc.yaml blueprints www/heizungsanlage-card.js"
 
 # Log to stderr: busybox sh block-buffers stdout when it is a pipe (as under
 # kubelet), so stdout log lines can sit unflushed for the lifetime of the loop.