diff --git a/modules/infra/providers.tf b/modules/infra/providers.tf
index 0b53b71..f276eed 100644
--- a/modules/infra/providers.tf
+++ b/modules/infra/providers.tf
@@ -1,12 +1,15 @@
 provider "vault" {
   address = var.vault_address
+  # The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create
+  # is denied); use the login token directly.
+  skip_child_token = true
 }
 
 # KeaAPI and NetBox tokens live in a single Vault KV v2 secret. The vault
 # provider authenticates with the VAULT_TOKEN set by the Makefile.
 data "vault_kv_secret_v2" "tokens" {
   mount = "kv"
-  name  = "service/terraform/ipam"
+  name  = "service/terraform/infra"
 }
 
 provider "netbox" {