diff --git a/config/netbox_secret_backend_role/netbox/puppet-facts.yaml b/config/netbox_secret_backend_role/netbox/puppet-facts.yaml
deleted file mode 100644
index 7b4b014..0000000
--- a/config/netbox_secret_backend_role/netbox/puppet-facts.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-# Role minting ephemeral read-only NetBox tokens for the puppet netbox fact.
-# The fact (profiles::netbox::facts) only GETs this node's device/VM + interface
-# data, so tokens are read-only (write_enabled false). Longer TTLs than the
-# terraform-infra role because the token feeds a persistent, cache-backed fact.
-# Reading netbox/creds/puppet-facts mints a lease-bound token deleted from
-# NetBox on revoke/expiry.
-#
-# There is no puppet-host -> Vault auth in the estate, so no consumer policy
-# binds netbox/creds/puppet-facts: an operator mints from this role by hand and
-# seeds the token into hieradata (profiles::netbox::facts::api_token). See the
-# PR body for the flagged design choice.
----
-netbox_username: svc-puppet-facts
-write_enabled: false
-ttl: 86400     # 24h
-max_ttl: 259200 # 72h
diff --git a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml
index 880d607..fb61903 100644
--- a/config/netbox_secret_backend_role/netbox/terraform-infra.yaml
+++ b/config/netbox_secret_backend_role/netbox/terraform-infra.yaml
@@ -1,10 +1,10 @@
 # Role minting ephemeral NetBox tokens for the terraform-infra CI runner.
 # terraform-infra manages NetBox IPAM/devices, so tokens carry write access
-# (write_enabled true). Short TTLs because a token is minted per plan/apply and
-# revoked when the run's lease ends. Reading netbox/creds/terraform-infra mints
-# a lease-bound token deleted from NetBox on revoke/expiry.
+# (write_enabled true). Very short TTLs because a token is minted per plan/apply
+# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra
+# mints a lease-bound token deleted from NetBox on revoke/expiry.
 ---
 netbox_username: svc-terraform-infra
 write_enabled: true
-ttl: 3600      # 1h
-max_ttl: 14400 # 4h
+ttl: 120     # 2m
+max_ttl: 300 # 5m
diff --git a/policies/netbox/admin.yaml b/policies/netbox/admin.yaml
deleted file mode 100644
index 9a0cc6c..0000000
--- a/policies/netbox/admin.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-# Allow the vault deployer to manage the netbox token secrets engine: its
-# connection config (seeded admin token), in-place token rotation, and
-# token-minting roles.
-#
-# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting
-# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
-# import the plugin is the shared, sudo-protected wildcard in
-# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
-# mounting the engine uses the deployer's existing sys/mounts/* access, so no
-# new catalog/mount grant is added here (mirrors the gitea/rancher engines).
----
-rules:
-  # Engine connection config (NetBox URL, TLS, token_version, seeded admin token).
-  - path: "netbox/config"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-  # In-place rotation of the seeded admin token (write-only trigger).
-  - path: "netbox/config/rotate"
-    capabilities:
-      - create
-      - update
-  # Token-minting roles.
-  - path: "netbox/roles/*"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-      - list
-  - path: "netbox/roles"
-    capabilities:
-      - read
-      - list
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault