diff --git a/Makefile b/Makefile
index ddea560..b3356f4 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,8 @@ define vault_env
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
 	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-enc) && \
-	export ENCAPI_WRITE_TOKEN=$$(vault kv get -field=ENCAPI_WRITE_TOKEN kv/kubernetes/namespace/encapi/default/environment)
+	export ENCAPI_WRITE_TOKEN=$$(vault read -field=token identity/oidc/token/terraform-enc) && \
+	[ -n "$$ENCAPI_WRITE_TOKEN" ] || { echo "failed to read ENCAPI_WRITE_TOKEN" >&2; exit 1; }
 endef
 
 init:
diff --git a/README.md b/README.md
index 1ee3ac3..e908c15 100644
--- a/README.md
+++ b/README.md
@@ -34,8 +34,8 @@ ci/
 
 The encapi provider comes from the internal registry
 (`artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/encapi` v0.1.0). Writes to
-encapi are authenticated with `ENCAPI_WRITE_TOKEN`, read from Vault by the
-Makefile.
+encapi are authenticated with `ENCAPI_WRITE_TOKEN`, a Vault identity token
+minted by the Makefile from `identity/oidc/token/terraform-enc`.
 
 ## Data provenance