diff --git a/hosts/vault01/configuration.nix b/hosts/vault01/configuration.nix
index 1b1faef..4f4d53d 100644
--- a/hosts/vault01/configuration.nix
+++ b/hosts/vault01/configuration.nix
@@ -62,6 +62,16 @@
   # Or disable the firewall altogether.
   networking.firewall.enable = false;
 
+  # Vault fetches secrets from itself (after unseal)
+  vault.enable = true;
+  homelab.deploy.enable = true;
+
+  # Ensure vault-secret services wait for openbao to be unsealed
+  systemd.services.vault-secret-homelab-deploy-nkey = {
+    after = [ "openbao.service" ];
+    wants = [ "openbao.service" ];
+  };
+
   system.stateVersion = "25.11"; # Did you read the comment?
 }
 
diff --git a/terraform/vault/approle.tf b/terraform/vault/approle.tf
index 6719dff..721a88d 100644
--- a/terraform/vault/approle.tf
+++ b/terraform/vault/approle.tf
@@ -101,6 +101,13 @@ locals {
       ]
     }
 
+    # vault01: Vault server itself (fetches secrets from itself)
+    "vault01" = {
+      paths = [
+        "secret/data/hosts/vault01/*",
+      ]
+    }
+
   }
 }