diff --git a/k8s/infrastructure/minio/minio-tenant.yaml b/k8s/infrastructure/minio/minio-tenant.yaml
index b6d27b4..876d248 100644
--- a/k8s/infrastructure/minio/minio-tenant.yaml
+++ b/k8s/infrastructure/minio/minio-tenant.yaml
@@ -69,7 +69,7 @@ spec:
     - name: loki-chunks
     - name: loki-ruler
     - name: loki-admin
-
+    - name: vault
   # ── Declarative users (each references a Secret of the same name holding
   #    CONSOLE_ACCESS_KEY / CONSOLE_SECRET_KEY) ─────────────────────────────
   users:
@@ -89,23 +89,5 @@ spec:
 
   # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
   env:
-    - name: MINIO_IDENTITY_OPENID_CONFIG_URL
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
-    - name: MINIO_IDENTITY_OPENID_CLIENT_ID
-      value: "minio"
-    - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
-      valueFrom:
-        secretKeyRef:
-          name: minio-oidc
-          key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
-    - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
-      value: "policy"
     - name: MINIO_IDENTITY_OPENID_SCOPES
       value: "openid,profile,email,minio"
-    - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
-      value: "https://minio.riotpiao.com/oauth_callback"
-    - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
-      value: "Authentik"
-
-  # cert-manager handles TLS; no operator auto-cert.
-  requestAutoCert: false
diff --git a/k8s/security/iam/vault-values.yaml b/k8s/security/iam/vault-values.yaml
index dae8013..f357c1b 100644
--- a/k8s/security/iam/vault-values.yaml
+++ b/k8s/security/iam/vault-values.yaml
@@ -124,16 +124,18 @@ server:
       # s3_force_path_style: MinIO uses path-style URLs (not virtual-hosted).
       # disable_ssl: MinIO in this cluster has no TLS.
       storage "s3" {
-        endpoint            = "http://minio.storage.svc.cluster.local:9000"
+        endpoint            = "http://minio-cluster-hl.storage.svc.cluster.local:9000"
         bucket              = "vault"
         region              = "us-east-1"
         s3_force_path_style = "true"
         disable_ssl         = "true"
+        max_parallel        = 128
       }
 
       # api_addr: the address other Vault nodes (or HA standbys) use to reach
       # this node. Single-node standalone, but Vault requires it to be set.
-      api_addr = "http://vault.storage.svc.cluster.local:8200"
+      api_addr = "http://vault.iam.svc.cluster.local:8200"
+      cluster_addr = "https://vault-0.vault-internal.iam.svc.cluster.local:8201"
 
   # ── Service ─────────────────────────────────────────────────────────────────
   # NodePort 32171 — fallback for direct node access during bootstrap before
@@ -169,3 +171,4 @@ serverTelemetry:
     selectors: {}
     interval: 30s
     scrapeTimeout: 10s
+