diff --git a/services/vault/default.nix b/services/vault/default.nix
index 0ad86e1..973d221 100644
--- a/services/vault/default.nix
+++ b/services/vault/default.nix
@@ -10,6 +10,8 @@
       listener.default = {
         type = "tcp";
         address = "0.0.0.0:8200";
+        tls_cert_file = "/var/openbao/cert.pem";
+        tls_key_file = "/var/openbao/key.pem";
       };
       listener.socket = {
         type = "unix";