diff --git a/apps/base/consul/kustomization.yaml b/apps/base/consul/kustomization.yaml
index 2c2b5da..217d383 100644
--- a/apps/base/consul/kustomization.yaml
+++ b/apps/base/consul/kustomization.yaml
@@ -6,3 +6,5 @@ resources:
   - namespace.yaml
   - gateway.yaml
   - httproute.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
diff --git a/apps/base/consul/vaultauth.yaml b/apps/base/consul/vaultauth.yaml
new file mode 100644
index 0000000..af9bee0
--- /dev/null
+++ b/apps/base/consul/vaultauth.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: consul
+spec:
+  allowedNamespaces:
+    - consul
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
diff --git a/apps/base/consul/vaultstaticsecret.yaml b/apps/base/consul/vaultstaticsecret.yaml
new file mode 100644
index 0000000..6cd7a6d
--- /dev/null
+++ b/apps/base/consul/vaultstaticsecret.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: bootstrap-acl-token
+  namespace: consul
+spec:
+  destination:
+    create: true
+    name: consul-bootstrap-acl-token
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/consul/default/bootstrap-acl-token
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
diff --git a/apps/overlays/au-syd1/consul/values.yaml b/apps/overlays/au-syd1/consul/values.yaml
index 424c6ee..cc9f434 100644
--- a/apps/overlays/au-syd1/consul/values.yaml
+++ b/apps/overlays/au-syd1/consul/values.yaml
@@ -3,6 +3,19 @@ global:
   datacenter: au-syd1
   domain: consul
 
+  acls:
+    # Enable chart-managed ACL tokens/policies for Consul system components.
+    manageSystemACLs: true
+    # Source the bootstrap/management token from a pre-existing Kubernetes secret
+    # instead of letting the chart generate one. The secret is synced from Vault
+    # via VSO (see ../../../base/consul/vaultauth.yaml and vaultstaticsecret.yaml).
+    # When this secret is populated the server-acl-init job SKIPS bootstrapping and
+    # uses the supplied token as the management token, so the k8s cluster bootstraps
+    # with the SAME initial_management token as the authoritative VM cluster.
+    bootstrapToken:
+      secretName: consul-bootstrap-acl-token
+      secretKey: token
+
 server:
   image: hashicorp/consul:1.22.7
   replicas: 5
@@ -17,6 +30,12 @@ server:
 
   extraConfig: |
     {
+      "acl": {
+        "enabled": true,
+        "default_policy": "deny",
+        "down_policy": "extend-cache",
+        "enable_token_persistence": true
+      },
       "disable_remote_exec": true,
       "disable_update_check": true,
       "performance": {