diff --git a/modules/infra/providers.tf b/modules/infra/providers.tf
index f276eed..84d25d2 100644
--- a/modules/infra/providers.tf
+++ b/modules/infra/providers.tf
@@ -5,8 +5,16 @@ provider "vault" {
   skip_child_token = true
 }
 
-# KeaAPI and NetBox tokens live in a single Vault KV v2 secret. The vault
-# provider authenticates with the VAULT_TOKEN set by the Makefile.
+# NetBox API token: minted per run by the vault-plugin-secrets-netbox engine
+# (netbox/creds/terraform-infra), lease-revoked when the run ends. This replaces
+# the static netbox_token that was seeded into KV by hand.
+data "vault_generic_secret" "netbox" {
+  path = "netbox/creds/terraform-infra"
+}
+
+# KeaAPI token still lives in the KV v2 secret (follow-up: give Kea its own
+# ephemeral-token engine). The vault provider authenticates with the VAULT_TOKEN
+# set by the Makefile.
 data "vault_kv_secret_v2" "tokens" {
   mount = "kv"
   name  = "service/terraform/infra"
@@ -14,7 +22,7 @@ data "vault_kv_secret_v2" "tokens" {
 
 provider "netbox" {
   server_url = var.netbox_server_url
-  api_token  = data.vault_kv_secret_v2.tokens.data["netbox_token"]
+  api_token  = data.vault_generic_secret.netbox.data["netbox_token"]
 }
 
 provider "kea" {