diff --git a/k8s/infra/iam/scripts/authentik-provision.py b/k8s/infra/iam/scripts/authentik-provision.py
index 7e5c249..427ba97 100644
--- a/k8s/infra/iam/scripts/authentik-provision.py
+++ b/k8s/infra/iam/scripts/authentik-provision.py
@@ -176,6 +176,7 @@ GROUP_PERMISSIONS = {
     "immich-admins": ["immich:read", "immich:write"],
     "poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"],
     "k8s-devops-admin": ["k8s:devops"],
+    "vault-service-api": ["vault:read", "vault:write"],
 }
 perms = set()
 for group in request.user.groups.all():
@@ -268,6 +269,10 @@ SERVICE_ADMIN_GROUP_NAMES = [
     "portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
     "paperless-admins", "immich-admins", "poimen-memory-admins",
     "k8s-devops-admin",
+    # Not a human-admin group like the others - Vault Identity Group aliasing
+    # target for service/API (non-browser) access to Vault, kept separate from
+    # homelab-admins' blanket "*" grant. See k8s/infra/iam/scripts/vault-provision.sh.
+    "vault-service-api",
 ]
 service_admin_groups = {}
 for group_name in SERVICE_ADMIN_GROUP_NAMES: