diff --git a/environments/root.hcl b/environments/root.hcl
index 955ce83..8667a77 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -8,8 +8,11 @@ provider "authentik" {
 }
 
 # Reads client secrets seeded in Vault (kv-v2). Auth via VAULT_ADDR + VAULT_TOKEN
-# from the environment (set by the Makefile vault_env helper).
-provider "vault" {}
+# from the environment (set by the Makefile vault_env helper). skip_child_token
+# is required because the short-lived CI token cannot create child tokens.
+provider "vault" {
+  skip_child_token = true
+}
 
 variable "authentik_token" {
   type      = string