diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index a9204fe..ab4013b 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -23,7 +23,7 @@ spec:
       labels:
         app: ghp
     spec:
-      serviceAccountName: ghp
+      serviceAccountName: default
       automountServiceAccountToken: true
       securityContext:
         runAsNonRoot: true
diff --git a/apps/base/ghp/kustomization.yaml b/apps/base/ghp/kustomization.yaml
index 2ba07f8..a4db15f 100644
--- a/apps/base/ghp/kustomization.yaml
+++ b/apps/base/ghp/kustomization.yaml
@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - namespace.yaml
-  - serviceaccount.yaml
   - configmap.yaml
   - cnpg_cluster.yaml
   - cnpg_backup.yaml
diff --git a/apps/base/ghp/migrate-job.yaml b/apps/base/ghp/migrate-job.yaml
index b067d12..443feef 100644
--- a/apps/base/ghp/migrate-job.yaml
+++ b/apps/base/ghp/migrate-job.yaml
@@ -25,7 +25,7 @@ spec:
       labels:
         app: ghp-migrate
     spec:
-      serviceAccountName: ghp
+      serviceAccountName: default
       automountServiceAccountToken: true
       restartPolicy: Never
       securityContext:
diff --git a/apps/base/ghp/serviceaccount.yaml b/apps/base/ghp/serviceaccount.yaml
deleted file mode 100644
index cba61fe..0000000
--- a/apps/base/ghp/serviceaccount.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-# Bound to the Vault K8s auth role "ghp" (added in terraform-vault); VSO uses the
-# VaultAuth below to exchange this SA's token for a Vault token and sync kv.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ghp
-  namespace: ghp
diff --git a/apps/base/ghp/vaultauth.yaml b/apps/base/ghp/vaultauth.yaml
index 1678ba0..05a1955 100644
--- a/apps/base/ghp/vaultauth.yaml
+++ b/apps/base/ghp/vaultauth.yaml
@@ -12,8 +12,8 @@ spec:
   kubernetes:
     audiences:
       - vault
-    role: ghp
-    serviceAccount: ghp
+    role: default
+    serviceAccount: default
     tokenExpirationSeconds: 600
   method: kubernetes
   mount: k8s/au/syd1
diff --git a/apps/base/ghp/vaultstaticsecret.yaml b/apps/base/ghp/vaultstaticsecret.yaml
index a44e926..1c454f3 100644
--- a/apps/base/ghp/vaultstaticsecret.yaml
+++ b/apps/base/ghp/vaultstaticsecret.yaml
@@ -1,6 +1,8 @@
 ---
-# GitHub App credentials (app_id, client_id, client_secret, private_key).
-# Ben populates kv/kubernetes/ghp/github-app via the runbook; VSO syncs it here.
+# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
+# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
+# default k8s role's templated policy already grants read here, so no
+# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -15,12 +17,13 @@ spec:
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: kubernetes/ghp/github-app
+  path: kubernetes/namespace/ghp/default/github-app
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
 ---
-# Application encryption key (encryption_key) from kv/kubernetes/ghp/app.
+# Application encryption key (encryption_key) from
+# kv/kubernetes/namespace/ghp/default/app.
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
 metadata:
@@ -35,7 +38,7 @@ spec:
     overwrite: true
   hmacSecretData: true
   mount: kv
-  path: kubernetes/ghp/app
+  path: kubernetes/namespace/ghp/default/app
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default