diff --git a/.woodpecker/deploy-almalinux9.yaml b/.woodpecker/deploy-almalinux9.yaml
index fcc028d..d2277f9 100644
--- a/.woodpecker/deploy-almalinux9.yaml
+++ b/.woodpecker/deploy-almalinux9.yaml
@@ -43,6 +43,13 @@ steps:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-el9"
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
@@ -51,7 +58,7 @@ steps:
             echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" -H @"$$AUTH" --data-binary @"$$rpm"
         done
     backend_options:
       kubernetes:
diff --git a/.woodpecker/deploy-fedora42.yaml b/.woodpecker/deploy-fedora42.yaml
index 461af6d..ca496ab 100644
--- a/.woodpecker/deploy-fedora42.yaml
+++ b/.woodpecker/deploy-fedora42.yaml
@@ -43,6 +43,13 @@ steps:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f42"
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
@@ -51,7 +58,7 @@ steps:
             echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" -H @"$$AUTH" --data-binary @"$$rpm"
         done
     backend_options:
       kubernetes:
diff --git a/.woodpecker/deploy-fedora43.yaml b/.woodpecker/deploy-fedora43.yaml
index bb46d46..4e153d5 100644
--- a/.woodpecker/deploy-fedora43.yaml
+++ b/.woodpecker/deploy-fedora43.yaml
@@ -43,6 +43,13 @@ steps:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f43"
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
@@ -51,7 +58,7 @@ steps:
             echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" -H @"$$AUTH" --data-binary @"$$rpm"
         done
     backend_options:
       kubernetes:
diff --git a/.woodpecker/deploy-fedora44.yaml b/.woodpecker/deploy-fedora44.yaml
index e875c8c..feaf701 100644
--- a/.woodpecker/deploy-fedora44.yaml
+++ b/.woodpecker/deploy-fedora44.yaml
@@ -43,6 +43,13 @@ steps:
       - |
         HOST="https://artifactapi.k8s.syd1.au.unkin.net"
         REPO="rpm-vendor-f44"
+        set -o pipefail
+        VAULT="https://vault.service.consul:8200"
+        AUTH=$$(mktemp)
+        VT=$$(jq -n --rawfile jwt /var/run/secrets/kubernetes.io/serviceaccount/token '{role:"woodpecker_artifactapi_writer",jwt:$$jwt}' \
+          | curl -sf -d @- "$$VAULT/v1/auth/k8s/au/syd1/login" | jq -er .auth.client_token) || exit 1
+        printf 'X-Vault-Token: %s\n' "$$VT" | curl -sf -H @- "$$VAULT/v1/identity/oidc/token/artifactapi-writer" \
+          | jq -er '"Authorization: Bearer " + .data.token' > "$$AUTH" || exit 1
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
           FILE=$$(basename "$$rpm")
           # artifactapi has no HEAD route (405); probe the served Packages path.
@@ -51,7 +58,7 @@ steps:
             echo "$$FILE already exists in $$REPO; skipping"
             continue
           fi
-          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" -H @"$$AUTH" --data-binary @"$$rpm"
         done
     backend_options:
       kubernetes: