For those who followed my “battle” with Aqara support regarding the T2 Dual Relay, I finally have the definitive solution. As many of you know, the current Matter implementation on the Hub M3 has a critical design flaw regarding physical security.
Here is a refresher on the original problem I reported to Aqara:
Hardware Setup:
- Device: Aqara Dual Relay Module T2 (Zigbee).
- Hub: Aqara Hub M3 (connected to Apple HomeKit via Matter).
- The Problem: The T2 Relay is forcibly exposed to HomeKit as a “Light”. Unlike their plugs, there is no option in the Aqara app to change the device type to “Switch”, “Outlet”, or “Garage Door” before passing it through Matter.
- The Critical Risk: If I say “Hey Siri, turn off all the lights” or if the “Good Night” scene triggers, Siri cuts power to my security cameras and activates the garage relay, OPENING THE DOOR. An unacceptable security breach.
Aqara’s response was that they would “keep it in mind” for future updates, but with no ETA. I wasn’t willing to compromise my home security while waiting, so I solved it 100% via Home Assistant.
Here is the tutorial on how to fix this:
The Technical Solution
The goal is to trick HomeKit. Instead of passing the device directly from Aqara to Apple, we use Home Assistant as a bridge to “disguise” the relay and convert it into the correct device type.
Step 1: The Logic in Home Assistant (YAML)
Depending on what your relay controls, we will create a different virtual entity in configuration.yaml (using Templates).
CASE A: For Garage Doors (We use cover) This ensures the correct Garage icon appears, Siri asks for authentication before opening, and it works natively with CarPlay.
template:
- cover:
- name: "Garage Door"
unique_id: cover_garage_door
device_class: garage # KEY: This tells Apple it's a real Garage Door
# Translates the relay state (on/off) to door state (open/closed)
state: "{{ 'open' if is_state('light.aqara_t2_relay_entity', 'on') else 'closed' }}"
# Actions that trigger the actual relay
open_cover:
action: light.turn_on
target:
entity_id: light.aqara_t2_relay_entity
close_cover:
action: light.turn_off
target:
entity_id: light.aqara_t2_relay_entity
stop_cover:
action: light.turn_on
target:
entity_id: light.aqara_t2_relay_entity
CASE B: For Cameras, Pumps, or Outlets (We use switch) Use this if you use the T2 to power security cameras and don’t want them to turn off when you turn off the lights.
template:
- switch:
- name: "Garden Camera"
unique_id: switch_garden_camera
state: "{{ is_state('light.aqara_t2_relay_entity', 'on') }}"
icon: mdi:cctv
turn_on:
action: light.turn_on
target:
entity_id: light.aqara_t2_relay_entity
turn_off:
action: light.turn_off
target:
entity_id: light.aqara_t2_relay_entity
Step 2: Cleanup in Home Assistant (Hide the Original)
Once the virtual entities are created, we will have duplicates in Home Assistant (the new Garage/Switch and the old original “Light”).
- Go to Settings > Devices & Services > Entities.
- Search for the original entity (
light.aqara_t2_relay_entity). - Open its settings and toggle off “Visible”. This keeps the HA dashboard clean and prevents accidental triggers.
Step 3: Apple Integration (HomeKit Bridge)
By passing these new entities through the HomeKit Bridge integration:
- Siri Security: The garage will require authentication (FaceID/Passcode) to open. Cameras won’t turn off when saying “turn off lights” (because they are now Switches, not Lights).
- CarPlay: When arriving home, the “Open Garage” button appears automatically on the car dashboard.
- Iconography: Every device has its real icon (Door or Switch), not a lightbulb.
Step 4: “Quarantine” Strategy for the Original Matter Device
Since the Hub M3 manages my Thread network, I cannot unlink it from Apple. To prevent Siri from seeing or using the “bad” original relay:
- In the Apple Home app, I renamed the original Aqara device to
ZZ_IGNORE. - I moved it to a fake room called “SYSTEM” (a digital trash bin).
- I removed it from Favorites and Status Summaries.
- I ensured it is NOT included in any scenes like “Good Night” or “Leave Home”.
- If possible, set it to show as a “Fan” or “Outlet” in HomeKit settings to further isolate it from light commands.
Conclusion
This method works for ANY Aqara T2 Relay. It doesn’t matter if you use it for a garage door, to reboot a router, for a pool pump, or for cameras. If HomeKit insists on calling it a “Light,” this method (Switch or Cover via HA) solves the security and usability issues forever, without waiting for Aqara firmware updates.
