diff --git a/config/plugins/vault-plugin-secrets-litellm.yaml b/config/plugins/vault-plugin-secrets-litellm.yaml
new file mode 100644
index 0000000..1bdff8a
--- /dev/null
+++ b/config/plugins/vault-plugin-secrets-litellm.yaml
@@ -0,0 +1,13 @@
+# config/plugins/vault-plugin-secrets-litellm.yaml
+# Imports (registers) the litellm secrets plugin in the catalog. This plugin was
+# registered manually before terraform managed the catalog, so its state must be
+# imported before the first apply (see the PR description) — otherwise apply
+# tries to create an entry that already exists.
+#
+# sha256 is the released v0.1.1 openbao binary
+# (openbao-plugin-secrets-litellm RPM -> /opt/openbao-plugins/vault-plugin-secrets-litellm),
+# which Puppet installs floating. Verify against the live catalog during import
+# (`bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm`).
+type: secret
+command: vault-plugin-secrets-litellm
+sha256: "2263ebcb3498877a87ddcf31a9cbc6efca6b81702a5faecf7fe7e40200ca7a1f"