diff --git a/policies/kv/service/terraform/incus-encapi-environment.yaml b/policies/kv/service/terraform/incus-encapi-environment.yaml
new file mode 100644
index 0000000..b9375d0
--- /dev/null
+++ b/policies/kv/service/terraform/incus-encapi-environment.yaml
@@ -0,0 +1,12 @@
+# Allow the Terraform Incus runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can dual-write ENC data to encapi via
+# the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_incus