diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml
index 06d5df7..7d6562b 100644
--- a/hieradata/roles/infra/storage/vault.yaml
+++ b/hieradata/roles/infra/storage/vault.yaml
@@ -27,8 +27,14 @@ profiles::nginx::simpleproxy::proxy_port: 8200
 profiles::nginx::simpleproxy::proxy_path: '/'
 
 profiles::packages::include:
+  # openbao-plugins (base bundle) left unpinned; it tracks the openbao package.
   openbao-plugins: {}
-  openbao-plugin-secrets-litellm: {}
-  openbao-plugin-secrets-gpg: {}
+  # Secrets plugins pinned to the exact version whose binary matches the sha256
+  # registered in terraform-vault (config/plugins/*.yaml). Bump both in lockstep
+  # on upgrade, or OpenBao refuses to launch the plugin after a restart.
+  openbao-plugin-secrets-litellm:
+    ensure: '0.1.1'
+  openbao-plugin-secrets-gpg:
+    ensure: '0.1.0'
   openbao-plugin-secrets-rancher:
-    ensure: latest
+    ensure: '0.1.1'