diff --git a/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml b/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml
new file mode 100644
index 0000000..ec6b78b
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml
@@ -0,0 +1,10 @@
+---
+# Kubernetes auth role for rspamd: the rspamd service account in the mail
+# namespace, used by VaultDynamicSecret to read litellm/creds/rspamd.
+bound_service_account_names:
+  - rspamd
+bound_service_account_namespaces:
+  - mail
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/config/litellm_secret_backend_role/litellm/rspamd.yaml b/config/litellm_secret_backend_role/litellm/rspamd.yaml
index 340fb58..29fe2ec 100644
--- a/config/litellm_secret_backend_role/litellm/rspamd.yaml
+++ b/config/litellm_secret_backend_role/litellm/rspamd.yaml
@@ -1,7 +1,6 @@
 ---
 models:
   - claude-haiku-4-5
-  - claude-sonnet-4-6
 max_budget: 50
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
diff --git a/policies/litellm/creds/rspamd.yaml b/policies/litellm/creds/rspamd.yaml
new file mode 100644
index 0000000..c022f9b
--- /dev/null
+++ b/policies/litellm/creds/rspamd.yaml
@@ -0,0 +1,10 @@
+# Lets rspamd mint a Haiku-scoped LiteLLM virtual key for its GPT/LLM module.
+---
+rules:
+  - path: "litellm/creds/rspamd"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - rspamd