diff --git a/modules/k8s-secret/main.tf b/modules/k8s-secret/main.tf
index bfa05ac..000e1af 100644
--- a/modules/k8s-secret/main.tf
+++ b/modules/k8s-secret/main.tf
@@ -183,9 +183,6 @@ locals {
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : secret.type == "database" && local.database_outputs_by_secret[name] != null ? merge(
       # Базовые поля из database outputs
@@ -201,10 +198,6 @@ locals {
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      # Рандомные поля
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : secret.type == "database_url" && local.database_outputs_by_secret[name] != null ? merge(
       {
@@ -220,9 +213,6 @@ locals {
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : secret.type == "valkey" && local.valkey_outputs_by_secret[name] != null ? merge(
       {
@@ -236,35 +226,23 @@ locals {
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : secret.type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null ? merge(
       local.rabbitmq_credentials_by_secret[name],
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : secret.type == "kafka" && local.kafka_outputs_by_secret[name] != null ? merge(
       local.kafka_credentials_by_secret[name],
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : merge(
       try(secret.custom_keys, {}),
       {
         for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
-      },
-      {
-        for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
     )
   }
@@ -291,6 +269,8 @@ locals {
       sink           = try(secret.sink, "k8s")
       vault_path     = try(secret.vault_path, "") != "" ? secret.vault_path : "${var.vault_path_prefix}/${secret.name}"
       data           = try(local.secrets_data[name], {})
+      # Явный data имеет приоритет над вычисляемыми, включая случайные ключи.
+      random_keys = contains(keys(local.secrets_data_override), name) ? {} : try(secret.random_keys, {})
     }
   }
 
@@ -337,7 +317,11 @@ resource "kubernetes_secret" "with_ignore" {
 
   type = each.value.k8s_type
 
-  data = each.value.data
+  # Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
+  # новый случайный ключ не делает data неизвестным у всех остальных секретов.
+  data = merge(each.value.data, {
+    for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
+  })
 
   lifecycle {
     # Игнорируем data, type и metadata чтобы не было phantom updates
@@ -357,7 +341,11 @@ resource "kubernetes_secret" "without_ignore" {
 
   type = each.value.k8s_type
 
-  data = each.value.data
+  # Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
+  # новый случайный ключ не делает data неизвестным у всех остальных секретов.
+  data = merge(each.value.data, {
+    for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
+  })
 
   lifecycle {
     # type и metadata игнорируем чтобы не было phantom updates
@@ -370,7 +358,9 @@ resource "kubernetes_secret" "without_ignore" {
 resource "vault_kv_secret_v2" "this" {
   for_each = local.secrets_vault
 
-  mount     = var.vault_kv_mount
-  name      = each.value.vault_path
-  data_json = jsonencode(each.value.data)
+  mount = var.vault_kv_mount
+  name  = each.value.vault_path
+  data_json = jsonencode(merge(each.value.data, {
+    for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
+  }))
 }