diff --git a/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml
new file mode 100644
index 0000000..e34a967
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/woodpecker_artifactapi_writer.yaml
@@ -0,0 +1,15 @@
+bound_service_account_names:
+  - default
+  - arrproxy-ci
+  - autobackup-operator-ci
+  - ghp
+  - jellyfin-plugin-sso
+  - kea-operator-ci
+  - mediamark-ci
+  - plugin-docker-buildx
+  - repospawner-ci
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
diff --git a/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml
new file mode 100644
index 0000000..8970509
--- /dev/null
+++ b/config/identity_oidc_role/artifactapi/artifactapi-writer.yaml
@@ -0,0 +1,3 @@
+---
+client_id: artifactapi
+ttl: 900
diff --git a/policies/identity/oidc/token/artifactapi-writer.yaml b/policies/identity/oidc/token/artifactapi-writer.yaml
new file mode 100644
index 0000000..91f213f
--- /dev/null
+++ b/policies/identity/oidc/token/artifactapi-writer.yaml
@@ -0,0 +1,13 @@
+---
+rules:
+  - path: "identity/oidc/token/artifactapi-writer"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - woodpecker_artifactapi_writer
+  ldap:
+    - vault_admin
+  oidc:
+    - akP-vault-admin