diff --git a/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml b/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml
index 0cea55c..4935fe3 100644
--- a/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml
+++ b/values/incubator-infra-gke-toolshed-prd-usc1-values.yaml
@@ -51,6 +51,17 @@ appSpec:
     # Contour's HTTPProxy CRD embeds a large schema, same 256KiB
     # last-applied-configuration problem as cert-manager's.
     serverSideApply: true
+  - name: vault
+    # Fresh install here, unlike the homelab's adoption of a running Vault.
+    # nameOverride pinned so the release is "vault" in namespace "vault":
+    # the Workload Identity binding Terraform created names that exact
+    # namespace/serviceaccount pair, and a different release name renames
+    # the service account, which leaves Vault unable to reach KMS and
+    # therefore sealed.
+    nameOverride: vault
+    namespace: vault
+    chartDir: vault
+    valuesDir: vault
   - name: cert-manager
     nameOverride: cert-manager
     namespace: cert-manager