diff --git a/config/arrstack_secret_backend_role/arrstack/mediamark.yaml b/config/arrstack_secret_backend_role/arrstack/mediamark.yaml
new file mode 100644
index 0000000..8935163
--- /dev/null
+++ b/config/arrstack_secret_backend_role/arrstack/mediamark.yaml
@@ -0,0 +1,17 @@
+---
+# Mints an arrproxy API key for the mediamark kids-content marking UI, scoped to
+# Sonarr and Radarr only (no Prowlarr: mediamark never touches indexers).
+#
+# mediamark only lists series/movies and reads metadata + artwork, so its key is
+# read-only in intent. The engine role cannot express that today: an
+# arrstack_secret_backend_role carries apps/ttl/max_ttl only, and arrproxy scopes
+# machine tokens by app, not by HTTP method (the GET/HEAD restriction on the
+# cheeztv/kids tier is a grant on an OIDC *group*, not on a minted token). Until
+# the engine and arrproxy grow per-token method scoping, mediamark's read-only
+# posture is enforced by the app itself and by the arrproxy tier it routes to.
+apps:
+  - radarr
+  - sonarr
+ttl: 60        # seconds (1m); short-lived by design, renewed on demand
+max_ttl: 86400 # seconds (24h); the engine additionally caps renewal at the
+               # arrproxy admin token's fixed mint expiry.
diff --git a/config/auth_kubernetes_role/k8s/au/syd1/mediamark.yaml b/config/auth_kubernetes_role/k8s/au/syd1/mediamark.yaml
new file mode 100644
index 0000000..6e583d6
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/mediamark.yaml
@@ -0,0 +1,10 @@
+---
+# Kubernetes auth role for the mediamark app: the default service account in the
+# mediamark namespace, used by VaultDynamicSecret to read arrstack/creds/mediamark.
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - mediamark
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/policies/arrstack/creds/mediamark.yaml b/policies/arrstack/creds/mediamark.yaml
new file mode 100644
index 0000000..0ec218f
--- /dev/null
+++ b/policies/arrstack/creds/mediamark.yaml
@@ -0,0 +1,12 @@
+# Allow the mediamark app to mint its own Sonarr/Radarr-scoped arrproxy key.
+# Bound to the dedicated "mediamark" k8s role only, never the shared "default"
+# role, so no other namespace can read these creds.
+---
+rules:
+  - path: "arrstack/creds/mediamark"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - mediamark