A security audit at your company flags that a Deployment named 'log-shipper' in the 'monitoring' namespace mounts a ServiceAccount token into its pods, even though the application never calls the Kubernetes API. You want to stop the token from being automatically mounted into the pods for this workload only, without deleting the ServiceAccount or affecting other workloads that use the same ServiceAccount. What is the correct approach?