diff --git a/policies/rancher/creds/ci.yaml b/policies/rancher/creds/ci.yaml
new file mode 100644
index 0000000..af066a9
--- /dev/null
+++ b/policies/rancher/creds/ci.yaml
@@ -0,0 +1,20 @@
+# Allow the terraform-rancher runner to mint an ephemeral Rancher API token
+# from the "ci" role, so its Makefile can swap
+#   vault kv get kv/service/terraform/rancher
+# for
+#   vault read -field=token rancher/creds/ci
+# and retire the static 90-day admin token. The minted token is lease-bound
+# (ttl 1h, max 8h) and deleted from Rancher on revoke; it inherits the seeded
+# admin service account's RBAC, so this is the same privilege as the static
+# token it replaces, just short-lived.
+---
+rules:
+  - path: "rancher/creds/ci"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_rancher
+  k8s/au/syd1:
+    - woodpecker_terraform_rancher