diff --git a/services/vault/hermes-auth-role-bootstrap-job.yaml b/services/vault/hermes-auth-role-bootstrap-job.yaml
index 39e0f3041..677162980 100644
--- a/services/vault/hermes-auth-role-bootstrap-job.yaml
+++ b/services/vault/hermes-auth-role-bootstrap-job.yaml
@@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: vault-k8s-auth-hermes-6
+  name: vault-k8s-auth-hermes-7
   namespace: vault
 spec:
   backoffLimit: 2
diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index e784837a5..8fd9de36d 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -226,7 +226,7 @@ write_policy_and_role "planka" "planka" "planka-vault" \
 write_policy_and_role "bstein-dev-home" "bstein-dev-home" "bstein-dev-home,bstein-dev-home-vault-sync" \
   "portal/* shared/chat-ai-keys-runtime shared/portal-e2e-client shared/postmark-relay mailu/mailu-initial-account-secret shared/harbor-pull" ""
 write_policy_and_role "gitea" "gitea" "gitea-vault" \
-  "gitea/*" "hermes/developer-gitea"
+  "gitea/*" "hermes/developer-gitea gitea/atlas-reconciler"
 write_policy_and_role "vaultwarden" "vaultwarden" "vaultwarden-vault" \
   "vaultwarden/* mailu/mailu-initial-account-secret" ""
 write_policy_and_role "sso" "sso" "sso-vault,sso-vault-sync,mas-secrets-ensure" \