diff --git a/k8s/mqtt-vaultstaticsecret.yaml b/k8s/mqtt-vaultstaticsecret.yaml
index b1ac7de..1741804 100644
--- a/k8s/mqtt-vaultstaticsecret.yaml
+++ b/k8s/mqtt-vaultstaticsecret.yaml
@@ -23,6 +23,11 @@ spec:
     create: true
     transformation:
       excludeRaw: true
+      # Drop ALL passthrough source keys (api_key, vantage_*, etc.) — keep only
+      # the templated MQTT_USERNAME/MQTT_PASSWORD below. Without this, envFrom
+      # would inject the entire home_assistant secret into the web container.
+      excludes:
+        - ".*"
       templates:
         MQTT_USERNAME:
           text: '{{ .Secrets.mqtt_user }}'