diff --git a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
index 8847abe..d325a0b 100644
--- a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
+++ b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
@@ -12,6 +12,11 @@ rules:
       - create
       - read
       - update
+  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply
+  # (403 here broke the terraform-git main apply, pipeline 107).
+  - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config"
+    capabilities:
+      - read
 
 auth:
   approle: