diff --git a/k8s/infra/iam/scripts/authentik-provision.py b/k8s/infra/iam/scripts/authentik-provision.py
index 702b0b7..7e5c249 100644
--- a/k8s/infra/iam/scripts/authentik-provision.py
+++ b/k8s/infra/iam/scripts/authentik-provision.py
@@ -394,6 +394,22 @@ SERVICES = {
         "launch_url": "https://img.riotpiao.com",
         "display_name": "Immich",
     },
+    "vault": {
+        # Human/CLI login only (`vault login -method=oidc`) - not wired to any
+        # workload. No secret exists yet - generate + store on first run.
+        # localhost:8250/oidc/callback is the vault CLI's documented fixed
+        # callback port for `vault login -method=oidc`; the other is the
+        # browser/UI flow's callback path (mount path "oidc").
+        "client_secret_source": ("iam", "vault-oidc", "CLIENT_SECRET"),
+        "generate_if_missing": True,
+        "extra_secret_literals": {"client-id": "vault"},
+        "redirect_uris": [
+            "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback",
+            "http://localhost:8250/oidc/callback",
+        ],
+        "launch_url": "https://vault.riotpiao.com",
+        "display_name": "Vault",
+    },
 }
 
 app_pks_for_binding = []