diff --git a/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml b/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml
new file mode 100644
index 0000000..baf8bd7
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/repospawner.yaml
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - repospawner
+bound_service_account_namespaces:
+  - repospawner
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/config/gitea_secret_backend_role/gitea/repospawner.yaml b/config/gitea_secret_backend_role/gitea/repospawner.yaml
new file mode 100644
index 0000000..ffcbfc1
--- /dev/null
+++ b/config/gitea_secret_backend_role/gitea/repospawner.yaml
@@ -0,0 +1,19 @@
+# Role minting ephemeral tokens for the repospawner service user. repospawner
+# creates and seeds Gitea repositories on demand, so it gets write on
+# repositories (create + push) and write on issues (issue/PR comments). Read is
+# implied by write. No admin/org/user-write scopes.
+# read:user is required because most API clients validate the login via
+# GET /api/v1/user, which 403s without it.
+# Reading gitea/creds/repospawner mints a lease-bound token deleted from Gitea
+# on revoke/expiry. Consumed by the repospawner pods via Kubernetes auth (see
+# policies/gitea/creds/repospawner.yaml) -- the agents AppRole is CIDR-bound to
+# Ben's workstation and cannot be used from in-cluster.
+---
+username: repospawner
+scopes:
+  - write:repository
+  - write:issue
+  - read:user
+token_name_prefix: vault-repospawner
+ttl: 3600      # 1h
+max_ttl: 14400 # 4h
diff --git a/policies/gitea/creds/repospawner.yaml b/policies/gitea/creds/repospawner.yaml
new file mode 100644
index 0000000..49352c6
--- /dev/null
+++ b/policies/gitea/creds/repospawner.yaml
@@ -0,0 +1,16 @@
+# Lets the repospawner pods mint ephemeral Gitea tokens for the repospawner
+# service user, so the service authenticates to git.unkin.net as its own
+# least-privilege identity. Reading gitea/creds/repospawner returns a
+# lease-bound token scoped by the role (write:repository, write:issue,
+# read:user -- never merge/admin).
+# Kubernetes auth only: repospawner runs in-cluster and the agents AppRole is
+# CIDR-bound to Ben's workstation.
+---
+rules:
+  - path: "gitea/creds/repospawner"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - repospawner