diff --git a/site/profiles/manifests/vault/server.pp b/site/profiles/manifests/vault/server.pp
index 665b2ea..e91cc5b 100644
--- a/site/profiles/manifests/vault/server.pp
+++ b/site/profiles/manifests/vault/server.pp
@@ -122,6 +122,15 @@ class profiles::vault::server (
       ]
     }
 
+    # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
+    # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
+    # socket of a long-lived plugin and orphaning the still-running process
+    # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
+    # such file). Exclude the sockets from cleaning for all plugins.
+    systemd::tmpfile { 'openbao-plugin-sockets.conf':
+      content => "x /tmp/plugin*\n",
+    }
+
     # ensure the vault audit log exists
     file { $audit_log:
       ensure => 'file',