diff --git a/.woodpecker/release.yaml b/.woodpecker/release.yaml
index 88f54b1..8ce12ff 100644
--- a/.woodpecker/release.yaml
+++ b/.woodpecker/release.yaml
@@ -6,11 +6,11 @@ steps:
   # Build the CA-baked plugin image and push it to artifactapi's docker-internal
   # registry. buildah runs unprivileged in-cluster (vfs + chroot isolation).
   #
-  # Push is credential-less: the in-cluster runner already has push access to the
-  # artifactapi docker-internal registry (same pattern as autobackup-operator /
-  # jellyfin-ha). --tls-verify=false is a deliberate bootstrap: THIS image is what
-  # teaches k8s buildx to trust artifactapi's internal CA, so its own push cannot
-  # yet rely on that trust.
+  # Push authenticates with a Vault-minted artifactapi-writer OIDC token fed to
+  # buildah login on stdin. The image has no jq, so the compact Vault JSON is
+  # parsed with sed. --tls-verify=false is a deliberate bootstrap: THIS image is
+  # what teaches k8s buildx to trust artifactapi's internal CA, so its own push
+  # cannot yet rely on that trust.
   #
   # Commands are quoted: woodpecker templates ${CI_COMMIT_TAG} into the raw YAML
   # before parsing, so an unquoted "-t $${IMG}:${CI_COMMIT_TAG} ." can collapse to
@@ -22,6 +22,14 @@ steps:
     commands:
       - "buildah build --isolation chroot --storage-driver vfs -t $${IMG}:${CI_COMMIT_TAG} ."
       - "buildah tag --storage-driver vfs $${IMG}:${CI_COMMIT_TAG} $${IMG}:latest"
+      - |
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        VT=$$(printf '{"role":"woodpecker_artifactapi_writer","jwt":"%s"}' "$$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+          | curl -sf --cacert unkin-ca.crt -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | sed -n 's/.*"client_token":"\([^"]*\)".*/\1/p') || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf --cacert unkin-ca.crt -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | sed -n 's/.*"token":"\([^"]*\)".*/\1/p' \
+          | buildah login --username woodpecker --password-stdin --tls-verify=false artifactapi.k8s.syd1.au.unkin.net || exit 1
       - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:${CI_COMMIT_TAG}"
       - "buildah push --storage-driver vfs --tls-verify=false $${IMG}:latest"
     backend_options: