@@ -484,11 +484,12 @@ limit. RBAC promotes sandbox CRD permissions to a ClusterRole and adds namespace
 Secret copies use server-side apply. Kubernetes authorizes an apply to an
 existing Secret as `patch`, but also requires `create` authorization when the
 target does not exist. RBAC cannot constrain `create` by `resourceNames`, so
-managed mode grants cluster-wide Secret `create`, `list`, and `delete` for
-generation-scoped bootstrap Secret creation and rollback recovery while keeping
-source reads and subsequent patches restricted to the explicitly configured TLS
-and image-pull Secret names. Recovery lists bootstrap Secrets by sandbox and
-component labels, then deletes stale generations with UID preconditions. The
+managed mode grants cluster-wide Secret `create` and `delete` for
+generation-scoped bootstrap Secret creation and rollback recovery. Patches are
+restricted to the explicitly configured TLS and image-pull Secret names, and
+source reads use a Role in the driver's source namespace. Recovery deletes the
+bootstrap Secrets of the recorded and target runtime generations by exact name;
+Pod owner references let garbage collection remove any other generation. The
 driver exercises these broad permissions only in gateway-owned managed
 namespaces. This depends on the managed-mode ownership invariant described below;
 the gateway ServiceAccount must not be shared with unrelated workloads.
 
@@ -13,7 +13,6 @@ use crate::isolation::{
 };
 use crate::sandbox_runtime::{
     BOUNDARY_CERTIFICATE_PATH, BOUNDARY_CONFIG_PATH, BOUNDARY_PRIVATE_KEY_PATH,
-    SANDBOX_SECRET_COMPONENT, SUPERVISOR_SECRET_COMPONENT,
     SUPERVISOR_TERMINATION_GRACE_PERIOD_SECONDS, SandboxRuntimeNames, boundary_service,
     generate_proxy_ca_material, sandbox_bootstrap_secret,
     sandbox_owner_reference as sandbox_runtime_sandbox_owner_reference,
@@ -3032,8 +3031,12 @@ impl KubernetesComputeDriver {
                 pod_is_gone,
             );
             if stop_is_complete {
-                self.delete_sandbox_runtime_supervisor(sandbox_id, &namespace)
-                    .await?;
+                self.delete_sandbox_runtime_supervisor(
+                    sandbox_id,
+                    &namespace,
+                    sandbox_runtime_generation(&object).as_slice(),
+                )
+                .await?;
                 patch_dynamic_object_with_resource_version_retry(
                     &agent_sandbox_api.api,
                     &kube_name,
@@ -3216,7 +3219,9 @@ impl KubernetesComputeDriver {
         let names = SandboxRuntimeNames::for_generation(sandbox_id, generation.as_str());
         self.create_sandbox_runtime_fence(&namespace, &names)
             .await?;
-        self.delete_sandbox_runtime_supervisor(sandbox_id, &namespace)
+        let mut stale_generations = sandbox_runtime_generation(&object).as_slice().to_vec();
+        stale_generations.push(generation.as_str());
+        self.delete_sandbox_runtime_supervisor(sandbox_id, &namespace, &stale_generations)
             .await?;
         let main_process_spec =
             required_sandbox_annotation(&object, ANNOTATION_SANDBOX_RUNTIME_MAIN_PROCESS_SPEC)?;
@@ -3499,40 +3504,28 @@ impl KubernetesComputeDriver {
         &self,
         sandbox_id: &str,
         namespace: &str,
+        generations: &[&str],
     ) -> Result<(), KubernetesDriverError> {
         self.delete_sandbox_runtime_supervisor_pod(sandbox_id, namespace)
             .await?;
-        self.delete_sandbox_runtime_generation_secrets(sandbox_id, namespace)
+        self.delete_sandbox_runtime_generation_secrets(sandbox_id, namespace, generations)
             .await
     }
 
+    /// Delete the bootstrap Secrets of the given runtime generations by exact
+    /// name. Garbage collection through their owner Pods removes older
+    /// generations.
     async fn delete_sandbox_runtime_generation_secrets(
         &self,
         sandbox_id: &str,
         namespace: &str,
+        generations: &[&str],
     ) -> Result<(), KubernetesDriverError> {
         let secrets = Api::<Secret>::namespaced(self.client.clone(), namespace);
-        for component in [SANDBOX_SECRET_COMPONENT, SUPERVISOR_SECRET_COMPONENT] {
-            let selector =
-                format!("openshell.ai/sandbox-id={sandbox_id},openshell.ai/component={component}");
-            let items = secrets
-                .list(&ListParams::default().labels(&selector))
-                .await
-                .map_err(KubernetesDriverError::from_kube)?;
-            for secret in items {
-                let Some(name) = secret.metadata.name else {
-                    continue;
-                };
-                match secrets
-                    .delete(
-                        &name,
-                        &DeleteParams::default().preconditions(Preconditions {
-                            uid: secret.metadata.uid,
-                            resource_version: None,
-                        }),
-                    )
-                    .await
-                {
+        for generation in generations {
+            let names = SandboxRuntimeNames::for_generation(sandbox_id, generation);
+            for name in [&names.sandbox_secret, &names.supervisor_secret] {
+                match secrets.delete(name, &DeleteParams::default()).await {
                     Ok(_) | Err(KubeError::Api(kube::core::ErrorResponse { code: 404, .. })) => {}
                     Err(error) => return Err(KubernetesDriverError::from_kube(error)),
                 }
@@ -3884,7 +3877,12 @@ impl KubernetesComputeDriver {
                 }
             }
             match self
-                .reconcile_sandbox_runtime_supervisor(&sandbox_id, namespace, desired_running)
+                .reconcile_sandbox_runtime_supervisor(
+                    &sandbox_id,
+                    namespace,
+                    desired_running,
+                    sandbox_runtime_generation(&object).as_slice(),
+                )
                 .await
             {
                 Ok(()) => {}
@@ -3938,7 +3936,11 @@ impl KubernetesComputeDriver {
             }
         }
         if let Err(error) = self
-            .delete_sandbox_runtime_supervisor(sandbox_id, namespace)
+            .delete_sandbox_runtime_supervisor(
+                sandbox_id,
+                namespace,
+                sandbox_runtime_generation(object).as_slice(),
+            )
             .await
         {
             warn!(sandbox_id, %error, "could not finish sandbox-runtime suspension cleanup");
@@ -4208,10 +4210,11 @@ impl KubernetesComputeDriver {
         sandbox_id: &str,
         namespace: &str,
         desired_running: bool,
+        generations: &[&str],
     ) -> Result<(), KubernetesDriverError> {
         if !desired_running {
             return self
-                .delete_sandbox_runtime_supervisor(sandbox_id, namespace)
+                .delete_sandbox_runtime_supervisor(sandbox_id, namespace, generations)
                 .await;
         }
         let names = SandboxRuntimeNames::new(sandbox_id);
@@ -8440,6 +8443,7 @@ mod tests {
                 "resourceVersion": "42",
                 "annotations": {
                     SANDBOX_POD_NAME_ANNOTATION: "workload-pod",
+                    ANNOTATION_SANDBOX_RUNTIME_GENERATION: "gen-7",
                     ANNOTATION_SANDBOX_RUNTIME_BOOTSTRAP_PHASE:
                         SandboxRuntimeBootstrapPhase::Suspending.as_str()
                 }
@@ -8455,12 +8459,6 @@ mod tests {
                 serde_json::json!({"kind": "Status", "status": "Success", "code": 200}),
             )
         };
-        let no_secrets = || {
-            kube_test_response(
-                http::StatusCode::OK,
-                serde_json::json!({"apiVersion": "v1", "kind": "SecretList", "items": []}),
-            )
-        };
         let steps = Arc::new(std::sync::Mutex::new(VecDeque::from([
             (
                 http::Method::GET,
@@ -8504,14 +8502,14 @@ mod tests {
                 kube_test_not_found("pods", "os-supervisor-sandbox-1"),
             ),
             (
-                http::Method::GET,
-                "/api/v1/namespaces/openshell/secrets",
-                no_secrets(),
+                http::Method::DELETE,
+                "/api/v1/namespaces/openshell/secrets/os-sandbox-sandbox-1-gen7",
+                success(),
             ),
             (
-                http::Method::GET,
-                "/api/v1/namespaces/openshell/secrets",
-                no_secrets(),
+                http::Method::DELETE,
+                "/api/v1/namespaces/openshell/secrets/os-supervisor-sandbox-1-gen7",
+                kube_test_not_found("secrets", "os-supervisor-sandbox-1-gen7"),
             ),
             (
                 http::Method::GET,
 
@@ -169,6 +169,26 @@ Namespace where sandbox pods are created. An explicit
 {{- .Values.server.sandboxNamespace | default .Release.Namespace -}}
 {{- end }}
 
+{{/*
+Secrets the Kubernetes driver copies from the sandbox namespace into
+workspace namespaces, as a JSON array. Empty in shared workspace mode.
+*/}}
+{{- define "openshell.copiedWorkspaceSecretNames" -}}
+{{- $workspaceMode := .Values.server.drivers.kubernetes.workspaceMode | default "shared" -}}
+{{- $names := list -}}
+{{- if and (ne $workspaceMode "shared") (not .Values.server.disableTls) -}}
+{{- $names = append $names .Values.server.tls.clientTlsSecretName -}}
+{{- end -}}
+{{- if eq $workspaceMode "managed" -}}
+{{- range .Values.server.sandboxImagePullSecrets -}}
+{{- if .name -}}
+{{- $names = append $names .name -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- uniq $names | toJson -}}
+{{- end }}
+
 {{/*
 Namespace where Kubernetes Secret-backed provider credentials live.
 */}}
 
@@ -89,34 +89,24 @@ rules:
       - patch
       - watch
   {{- end }}
-  {{- $copiedSecretNames := list }}
-  {{- if and (ne $workspaceMode "shared") (not .Values.server.disableTls) }}
-  {{- $copiedSecretNames = append $copiedSecretNames .Values.server.tls.clientTlsSecretName }}
-  {{- end }}
-  {{- if eq $workspaceMode "managed" }}
-  {{- range .Values.server.sandboxImagePullSecrets }}
-  {{- if .name }}
-  {{- $copiedSecretNames = append $copiedSecretNames .name }}
-  {{- end }}
-  {{- end }}
-  {{- end }}
   {{- if ne $workspaceMode "shared" }}
   - apiGroups: [""]
     resources: ["services"]
     verbs: ["create", "get"]
   - apiGroups: [""]
     resources: ["secrets"]
-    # Bootstrap Secrets are generation-scoped. Recovery lists them by label and
-    # deletes stale generations with UID preconditions before retrying creation.
-    verbs: ["create", "list", "delete"]
+    # Bootstrap Secrets are generation-scoped. Recovery deletes them by exact
+    # name.
+    verbs: ["create", "delete"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
     verbs: ["create", "get"]
   {{- end }}
-  {{- $copiedSecretNames = uniq $copiedSecretNames }}
+  {{- $copiedSecretNames := include "openshell.copiedWorkspaceSecretNames" . | fromJsonArray }}
   {{- if $copiedSecretNames }}
   # Copy only explicitly configured TLS and image-pull Secrets into workspace
   # namespaces. Server-side apply authorizes these requests as patch operations.
+  # Reading the source Secrets is granted by a Role in the sandbox namespace.
   - apiGroups:
       - ""
     resources:
@@ -126,7 +116,6 @@ rules:
       - {{ . | quote }}
       {{- end }}
     verbs:
-      - get
       - patch
   # Server-side apply uses PATCH for an existing Secret, but the API server
   # additionally authorizes CREATE when the named Secret does not exist yet.
 
@@ -59,9 +59,9 @@ rules:
     verbs: ["create", "get"]
   - apiGroups: [""]
     resources: ["secrets"]
-    # Bootstrap Secrets are generation-scoped. Recovery lists them by label and
-    # deletes stale generations with UID preconditions before retrying creation.
-    verbs: ["create", "list", "delete"]
+    # Bootstrap Secrets are generation-scoped. Recovery deletes them by exact
+    # name.
+    verbs: ["create", "delete"]
   - apiGroups: ["networking.k8s.io"]
     resources: ["networkpolicies"]
     verbs: ["create", "get"]
 
@@ -0,0 +1,25 @@
+{{- $copiedSecretNames := include "openshell.copiedWorkspaceSecretNames" . | fromJsonArray }}
+{{- if $copiedSecretNames }}
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# Read the TLS and image-pull Secrets the gateway copies into workspace
+# namespaces.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "openshell.fullname" . }}-workspace-secret-source
+  namespace: {{ include "openshell.sandboxNamespace" . }}
+  labels:
+    {{- include "openshell.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    resourceNames:
+      {{- range $copiedSecretNames }}
+      - {{ . | quote }}
+      {{- end }}
+    verbs:
+      - get
+{{- end }}
@@ -0,0 +1,19 @@
+{{- if include "openshell.copiedWorkspaceSecretNames" . | fromJsonArray }}
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "openshell.fullname" . }}-workspace-secret-source
+  namespace: {{ include "openshell.sandboxNamespace" . }}
+  labels:
+    {{- include "openshell.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "openshell.fullname" . }}-workspace-secret-source
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "openshell.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}
@@ -114,7 +114,7 @@ tests:
             apiGroups: [""]
             resources: ["secrets"]
             resourceNames: ["custom-client-tls"]
-            verbs: ["get", "patch"]
+            verbs: ["patch"]
 
   - it: grants operator bootstrap secret lifecycle permissions when TLS and credential storage are disabled
     set:
@@ -126,7 +126,7 @@ tests:
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
       - notContains:
           path: rules
           content:
@@ -148,13 +148,13 @@ tests:
             apiGroups: [""]
             resources: ["secrets"]
             resourceNames: ["custom-client-tls", "registry-one", "registry-two"]
-            verbs: ["get", "patch"]
+            verbs: ["patch"]
       - contains:
           path: rules
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
 
   - it: restricts managed copies to image-pull secrets when TLS is disabled
     set:
@@ -169,13 +169,13 @@ tests:
             apiGroups: [""]
             resources: ["secrets"]
             resourceNames: ["registry-one"]
-            verbs: ["get", "patch"]
+            verbs: ["patch"]
       - contains:
           path: rules
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
 
   - it: omits secrets rule entirely in shared mode
     set:
@@ -209,7 +209,7 @@ tests:
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
 
   - it: grants operator sandbox-runtime companion permissions
     set:
@@ -232,4 +232,4 @@ tests:
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
@@ -73,7 +73,7 @@ tests:
           content:
             apiGroups: [""]
             resources: ["secrets"]
-            verbs: ["create", "list", "delete"]
+            verbs: ["create", "delete"]
       - notContains:
           path: rules
           content: