diff --git a/apps/base/logging/clickhouseinstallation.yaml b/apps/base/logging/clickhouseinstallation.yaml
index f6b63f0..08e7d9a 100644
--- a/apps/base/logging/clickhouseinstallation.yaml
+++ b/apps/base/logging/clickhouseinstallation.yaml
@@ -29,9 +29,26 @@ spec:
       default/networks/ip:
         - "127.0.0.1"
         - "::1"
+      # Read-only user for CLI tools + the logviewer UI. Hash sourced from the
+      # Vault-synced clickhouse-logreader Secret, same mechanism as vector.
+      # Scoped to the logs database only (unlike vector, which bootstraps it).
+      logreader/password_sha256_hex:
+        valueFrom:
+          secretKeyRef:
+            name: clickhouse-logreader
+            key: password_sha256_hex
+      logreader/networks/ip:
+        - "::/0"
+      logreader/profile: readonly
+      logreader/quota: default
+      logreader/allow_databases/database:
+        - "logs"
     profiles:
       default/max_memory_usage: "10000000000"
       default/max_execution_time: "120"
+      readonly/readonly: "1"
+      readonly/max_memory_usage: "10000000000"
+      readonly/max_execution_time: "120"
     clusters:
       - name: logs
         layout:
diff --git a/apps/base/logging/vaultstaticsecret.yaml b/apps/base/logging/vaultstaticsecret.yaml
index 45b56ab..9113945 100644
--- a/apps/base/logging/vaultstaticsecret.yaml
+++ b/apps/base/logging/vaultstaticsecret.yaml
@@ -27,6 +27,29 @@ spec:
   type: kv-v2
   vaultAuthRef: default
 ---
+# ClickHouse credentials for the read-only `logreader` user (CLI tools +
+# logviewer UI). Seeded the same way as clickhouse-credentials above:
+#   PW=$(openssl rand -hex 24)
+#   HASH=$(printf '%s' "$PW" | sha256sum | cut -d' ' -f1)
+#   vault kv put kv/kubernetes/namespace/logging/default/clickhouse-logreader \
+#     username=logreader password="$PW" password_sha256_hex="$HASH"
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: clickhouse-logreader
+  namespace: logging
+spec:
+  destination:
+    create: true
+    name: clickhouse-logreader
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/logging/default/clickhouse-logreader
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
 # NATS JetStream auth. Distinct passwords for the producer (edge), consumer
 # (transform tier + archiver) and admin (bootstrap Job) users. Seed once:
 #   for k in admin producer consumer; do declare P_$k=$(openssl rand -base64 24); done