diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml
index b758647..634dd96 100644
--- a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml
@@ -1,4 +1,4 @@
 allowed_kubernetes_namespaces:
-  - "*"
-kubernetes_role_type: "ClusterRole"
+  - "bind-system"
+service_account_name: "agent-dns"
 extra_labels: {}
diff --git a/modules/vault_cluster/main.tf b/modules/vault_cluster/main.tf
index 3940844..e7851bb 100644
--- a/modules/vault_cluster/main.tf
+++ b/modules/vault_cluster/main.tf
@@ -299,6 +299,7 @@ module "kubernetes_secret_backend_role" {
   allowed_kubernetes_namespaces = each.value.allowed_kubernetes_namespaces
   kubernetes_role_type          = each.value.kubernetes_role_type
   extra_labels                  = each.value.extra_labels
+  service_account_name          = each.value.service_account_name
 
   depends_on = [module.kubernetes_secret_backend]
 }
diff --git a/modules/vault_cluster/modules/kubernetes_secret_backend_role/main.tf b/modules/vault_cluster/modules/kubernetes_secret_backend_role/main.tf
index 6833a9a..8e56de5 100644
--- a/modules/vault_cluster/modules/kubernetes_secret_backend_role/main.tf
+++ b/modules/vault_cluster/modules/kubernetes_secret_backend_role/main.tf
@@ -2,6 +2,10 @@ locals {
   # Auto-generate role rules path: resources/secret_backend/{backend_path}/roles/{role_name}.yaml
   role_rules_file = "resources/secret_backend/${var.backend}/roles/${var.name}.yaml"
 
+  # service_account_name mode mints tokens for a pre-existing SA, so the
+  # generated_role_rules / kubernetes_role_type binding fields must be unset.
+  use_service_account = var.service_account_name != null
+
   # Auto-generate extra labels based on country/region and role name
   auto_labels = merge(var.extra_labels, {
     vault-region = "${var.country}-${var.region}"
@@ -13,7 +17,8 @@ resource "vault_kubernetes_secret_backend_role" "role" {
   backend                       = var.backend
   name                          = var.name
   allowed_kubernetes_namespaces = var.allowed_kubernetes_namespaces
-  kubernetes_role_type          = var.kubernetes_role_type
-  generated_role_rules          = file("${path.module}/../../../../../../../../${local.role_rules_file}")
+  kubernetes_role_type          = local.use_service_account ? null : var.kubernetes_role_type
+  generated_role_rules          = local.use_service_account ? null : file("${path.module}/../../../../../../../../${local.role_rules_file}")
+  service_account_name          = var.service_account_name
   extra_labels                  = local.auto_labels
 }
diff --git a/modules/vault_cluster/modules/kubernetes_secret_backend_role/variables.tf b/modules/vault_cluster/modules/kubernetes_secret_backend_role/variables.tf
index 43d1fbf..af2a6a3 100644
--- a/modules/vault_cluster/modules/kubernetes_secret_backend_role/variables.tf
+++ b/modules/vault_cluster/modules/kubernetes_secret_backend_role/variables.tf
@@ -34,4 +34,10 @@ variable "extra_labels" {
   description = "Additional labels to apply to generated Kubernetes objects"
   type        = map(string)
   default     = {}
+}
+
+variable "service_account_name" {
+  description = "Pre-existing service account to mint tokens for. When set, RBAC comes from that SA's own bindings instead of generated_role_rules."
+  type        = string
+  default     = null
 }
\ No newline at end of file
diff --git a/modules/vault_cluster/variables.tf b/modules/vault_cluster/variables.tf
index 2c59ddc..87787f5 100644
--- a/modules/vault_cluster/variables.tf
+++ b/modules/vault_cluster/variables.tf
@@ -285,6 +285,7 @@ variable "kubernetes_secret_backend_role" {
     allowed_kubernetes_namespaces = optional(list(string), ["*"])
     kubernetes_role_type          = optional(string, "Role")
     extra_labels                  = optional(map(string), {})
+    service_account_name          = optional(string)
   }))
   default = {}
 }
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml
deleted file mode 100644
index ba92724..0000000
--- a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
----
-rules:
-  - apiGroups:
-      - "bind.unkin.net"
-    resources:
-      - "*"
-    verbs:
-      - "*"
-  - apiGroups:
-      - ""
-    resources:
-      - "pods"
-      - "services"
-      - "configmaps"
-      - "events"
-    verbs:
-      - "get"
-      - "list"
-      - "watch"
-  - apiGroups:
-      - ""
-    resources:
-      - "pods/log"
-    verbs:
-      - "get"
-      - "list"