environments/root.hcl

@@ -8,8 +8,11 @@ provider "authentik" {
 }
 
 # Reads client secrets seeded in Vault (kv-v2). Auth via VAULT_ADDR + VAULT_TOKEN
-# from the environment (set by the Makefile vault_env helper).
+# from the environment (set by the Makefile vault_env helper). skip_child_token
-provider "vault" {}
+# is required because the short-lived CI token cannot create child tokens.
+provider "vault" {
+  skip_child_token = true
+}
 
 variable "authentik_token" {
   type      = string