diff --git a/environments/root.hcl b/environments/root.hcl
index dcc54c5..0233a7f 100644
--- a/environments/root.hcl
+++ b/environments/root.hcl
@@ -67,7 +67,7 @@ terraform {
     }
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }
diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf
index 0ac715f..d31e35c 100644
--- a/modules/vault_cluster/main.tf
+++ b/modules/vault_cluster/main.tf
@@ -370,6 +370,7 @@ module "arrstack_secret_backend_role" {
   name    = each.value.name
   backend = each.value.backend
   apps    = each.value.apps
+  methods = each.value.methods
   ttl     = each.value.ttl
   max_ttl = each.value.max_ttl
 
diff --git a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf
index a16f196..6ab0265 100644
--- a/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf
+++ b/modules/vault_cluster/modules/arrstack_secret_backend/terraform.tf
@@ -7,7 +7,7 @@ terraform {
     }
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }
diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf
index 17bc124..90d93c9 100644
--- a/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf
+++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/main.tf
@@ -2,6 +2,7 @@ resource "arrstack_secret_backend_role" "this" {
   backend = var.backend
   name    = var.name
   apps    = var.apps
+  methods = var.methods
   ttl     = var.ttl
   max_ttl = var.max_ttl
 }
diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf
index b158d4b..cb0e7c0 100644
--- a/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf
+++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/terraform.tf
@@ -3,7 +3,7 @@ terraform {
   required_providers {
     arrstack = {
       source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
-      version = "0.1.1"
+      version = "0.2.0"
     }
   }
 }
diff --git a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf
index 022e978..c79ebd7 100644
--- a/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf
+++ b/modules/vault_cluster/modules/arrstack_secret_backend_role/variables.tf
@@ -13,6 +13,13 @@ variable "apps" {
   type        = list(string)
 }
 
+variable "methods" {
+  description = "HTTP methods a generated key is limited to (subset of GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS). Null leaves the role unrestricted"
+  type        = set(string)
+  # null, not [], so a role yaml that omits methods matches the provider's null read-back and shows no drift.
+  default = null
+}
+
 variable "ttl" {
   description = "Default lease TTL in seconds for keys generated from this role"
   type        = number
diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf
index 9b59df5..9fc6f2f 100644
--- a/modules/vault_cluster/variables.tf
+++ b/modules/vault_cluster/variables.tf
@@ -334,6 +334,7 @@ variable "arrstack_secret_backend_role" {
     name    = string
     backend = string
     apps    = list(string)
+    methods = optional(set(string))
     ttl     = optional(number)
     max_ttl = optional(number)
   }))