diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml
index 380d53b..4dd91be 100644
--- a/infrastructure/security-audit/base/helmrelease-collector.yaml
+++ b/infrastructure/security-audit/base/helmrelease-collector.yaml
@@ -157,11 +157,11 @@ spec:
           log_statements:
             - context: log
               statements:
-                # --- объём и шум ---
-                - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil
-                - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil
-                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil
-                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil
+                # --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) ---
+                - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil
+                - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil
+                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil
+                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil
                 # --- маскирование (п.23): значения, а не сама команда exec ---
                 - replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***")
                 # --- обогащение ---