diff --git a/src/wuttaweb/grids/base.py b/src/wuttaweb/grids/base.py
index 81c92ae..f0f45a1 100644
--- a/src/wuttaweb/grids/base.py
+++ b/src/wuttaweb/grids/base.py
@@ -2390,6 +2390,9 @@ class Grid:  # pylint: disable=too-many-instance-attributes,too-many-public-meth
             # convert record to new dict
             record = self.object_to_dict(record)
 
+            # discard non-declared fields
+            record = {field: record[field] for field in record if field in self.columns}
+
             # make all values safe for json
             record = make_json_safe(record, warn=False)
 
diff --git a/tests/grids/test_base.py b/tests/grids/test_base.py
index b0927e6..0087e93 100644
--- a/tests/grids/test_base.py
+++ b/tests/grids/test_base.py
@@ -1867,7 +1867,19 @@ class TestGrid(WebTestCase):
         context = grid.get_vue_context()
         self.assertEqual(context, {"data": [{"foo": "bar"}], "row_classes": {}})
 
+        # non-declared columns are discarded
+        mydata = [
+            {"foo": "a", "bar": "b", "baz": "c"},
+        ]
+        grid = self.make_grid(columns=["bar"], data=mydata)
+        context = grid.get_vue_context()
+        self.assertEqual(context, {"data": [{"bar": "b"}], "row_classes": {}})
+
         # if grid has actions, that list may be supplemented
+        mydata = [
+            {"foo": "bar"},
+        ]
+        grid = self.make_grid(columns=["foo"], data=mydata)
         grid.actions.append(mod.GridAction(self.request, "view", url="/blarg"))
         context = grid.get_vue_context()
         self.assertIsNot(context["data"], mydata)