diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index c0be2bd..3b47c83 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -54,10 +54,17 @@ steps:
           echo "$$PATH_IN_REPO already published (HTTP $$code); skipping upload"
           exit 0
         fi
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         echo "Uploading $$ZIP to $$REPO/$$PATH_IN_REPO (existence probe returned $$code)"
         curl -f -X PUT \
           "$$HOST/api/v2/remotes/$$REPO/files/$$PATH_IN_REPO" \
-          -H "Content-Type: application/zip" \
+          -H "Content-Type: application/zip" -H @"$$AUTH" \
           --data-binary @"$$ZIP"
         echo
         sha256sum "$$ZIP"