diff --git a/environments/root.hcl b/environments/root.hcl
index 83b3e5b..7413786 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -14,7 +14,11 @@ provider "woodpecker" {
 # Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
 # Makefile authenticates via k8s auth before running terragrunt). Used to seed
 # bot-account credentials into Vault KV (see modules/user vault_seed_path).
-provider "vault" {}
+# skip_child_token: the CI token from the k8s auth role cannot create child
+# tokens (apply fails with "failed to create limited child token").
+provider "vault" {
+  skip_child_token = true
+}
 
 terraform {
   backend "consul" {