diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml
index 061f592..a1ffa7f 100644
--- a/infrastructure/security-audit/base/helmrelease-collector.yaml
+++ b/infrastructure/security-audit/base/helmrelease-collector.yaml
@@ -159,7 +159,9 @@ spec:
         filter/audit:
           error_mode: ignore
           logs:
-            log_records:
+            # Ключ именно log_record (singular) — так в filterprocessor 0.121 (config.go).
+            # Запись отбрасывается, если любое условие истинно.
+            log_record:
               - 'IsMatch(body["user"]["username"], "^system:serviceaccount:flux-system:") and (body["verb"] == "get" or body["verb"] == "list" or body["verb"] == "watch")'
         transform/audit:
           error_mode: ignore