diff --git a/apps/base/cephrgw-system/vaultauth.yaml b/apps/base/cephrgw-system/vaultauth.yaml
index fe747e6..ceb64b7 100644
--- a/apps/base/cephrgw-system/vaultauth.yaml
+++ b/apps/base/cephrgw-system/vaultauth.yaml
@@ -11,8 +11,11 @@ spec:
   allowedNamespaces:
     - cephrgw-system
   kubernetes:
-    role: cephrgw-operator
-    serviceAccount: cephrgw-operator
+    # Shared "default" role: binds the namespace's default ServiceAccount and
+    # grants the templated kv/kubernetes/namespace/<ns>/<sa>/* read policy, so
+    # no per-app terraform-vault change is needed.
+    role: default
+    serviceAccount: default
     audiences:
       - vault
     tokenExpirationSeconds: 600
diff --git a/apps/base/cephrgw-system/vaultstaticsecret.yaml b/apps/base/cephrgw-system/vaultstaticsecret.yaml
index 6de026a..142cc74 100644
--- a/apps/base/cephrgw-system/vaultstaticsecret.yaml
+++ b/apps/base/cephrgw-system/vaultstaticsecret.yaml
@@ -3,6 +3,12 @@
 # Secret the operator Deployment consumes via envFrom. The KV secret's keys
 # (CEPH_DASHBOARD_URL/USERNAME/PASSWORD, optional CEPH_RGW_ENDPOINT/CA) are
 # copied verbatim, so they land as the matching env vars.
+#
+# The path sits under the templated default policy
+# (kv/data/kubernetes/namespace/<ns>/<sa>/*), so it needs no dedicated Vault
+# role or policy. Seed the values with:
+#   vault kv put kv/kubernetes/namespace/cephrgw-system/default/cephrgw-credentials \
+#     CEPH_DASHBOARD_URL=... CEPH_DASHBOARD_USERNAME=... CEPH_DASHBOARD_PASSWORD=...
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -12,7 +18,7 @@ spec:
   vaultAuthRef: default
   mount: kv
   type: kv-v2
-  path: service/cephrgw/dashboard-credentials
+  path: kubernetes/namespace/cephrgw-system/default/cephrgw-credentials
   refreshAfter: 5m
   hmacSecretData: true
   destination: