diff --git a/apps/base/bind-external/agent-dns-rolebinding.yaml b/apps/base/bind-external/agent-dns-rolebinding.yaml
new file mode 100644
index 0000000..7a7ffb6
--- /dev/null
+++ b/apps/base/bind-external/agent-dns-rolebinding.yaml
@@ -0,0 +1,16 @@
+---
+# Confines the agent-dns service account (in bind-system) to the agent-dns
+# ClusterRole within this namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: agent-dns
+  namespace: bind-external
+subjects:
+  - kind: ServiceAccount
+    name: agent-dns
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: agent-dns
diff --git a/apps/base/bind-external/kustomization.yaml b/apps/base/bind-external/kustomization.yaml
index de5a685..1e3ed86 100644
--- a/apps/base/bind-external/kustomization.yaml
+++ b/apps/base/bind-external/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - cluster.yaml
   - tsigkey.yaml
   - zones.yaml
+  - agent-dns-rolebinding.yaml
diff --git a/apps/base/bind-internal/agent-dns-rolebinding.yaml b/apps/base/bind-internal/agent-dns-rolebinding.yaml
new file mode 100644
index 0000000..6704086
--- /dev/null
+++ b/apps/base/bind-internal/agent-dns-rolebinding.yaml
@@ -0,0 +1,16 @@
+---
+# Confines the agent-dns service account (in bind-system) to the agent-dns
+# ClusterRole within this namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: agent-dns
+  namespace: bind-internal
+subjects:
+  - kind: ServiceAccount
+    name: agent-dns
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: agent-dns
diff --git a/apps/base/bind-internal/kustomization.yaml b/apps/base/bind-internal/kustomization.yaml
index 112b5d8..d2f50fb 100644
--- a/apps/base/bind-internal/kustomization.yaml
+++ b/apps/base/bind-internal/kustomization.yaml
@@ -8,3 +8,4 @@ resources:
   - resolvers
   - externaldns
   - tsig-api
+  - agent-dns-rolebinding.yaml
diff --git a/apps/base/bind-system/agent-dns-rbac.yaml b/apps/base/bind-system/agent-dns-rbac.yaml
new file mode 100644
index 0000000..c5db3d1
--- /dev/null
+++ b/apps/base/bind-system/agent-dns-rbac.yaml
@@ -0,0 +1,38 @@
+---
+# Static service account that Vault's kubernetes secret engine mints scoped
+# tokens for (agent-dns role). RBAC is confined to the bind namespaces via the
+# per-namespace RoleBindings below, not a ClusterRoleBinding.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: agent-dns
+  namespace: bind-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: agent-dns
+rules:
+  - apiGroups: ["bind.unkin.net"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    resources: ["pods", "services", "configmaps", "events"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: agent-dns
+  namespace: bind-system
+subjects:
+  - kind: ServiceAccount
+    name: agent-dns
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: agent-dns
diff --git a/apps/base/bind-system/kustomization.yaml b/apps/base/bind-system/kustomization.yaml
index 453e5d6..3562333 100644
--- a/apps/base/bind-system/kustomization.yaml
+++ b/apps/base/bind-system/kustomization.yaml
@@ -8,5 +8,6 @@ resources:
   # vendored here, so they never drift from the operator.
   - https://git.unkin.net/unkin/bind-operator/raw/tag/v0.2.6/config/crd/install.yaml
   - rbac.yaml
+  - agent-dns-rbac.yaml
   - deployment.yaml
   - vpa.yaml
diff --git a/apps/base/externaldns/agent-dns-rolebinding.yaml b/apps/base/externaldns/agent-dns-rolebinding.yaml
new file mode 100644
index 0000000..a15bd7d
--- /dev/null
+++ b/apps/base/externaldns/agent-dns-rolebinding.yaml
@@ -0,0 +1,16 @@
+---
+# Confines the agent-dns service account (in bind-system) to the agent-dns
+# ClusterRole within this namespace.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: agent-dns
+  namespace: externaldns
+subjects:
+  - kind: ServiceAccount
+    name: agent-dns
+    namespace: bind-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: agent-dns
diff --git a/apps/base/externaldns/kustomization.yaml b/apps/base/externaldns/kustomization.yaml
index cc622a0..08ca6ac 100644
--- a/apps/base/externaldns/kustomization.yaml
+++ b/apps/base/externaldns/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - agent-dns-rolebinding.yaml