diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index d47ebb5..daf0214 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -154,7 +154,7 @@ write_policy_and_role "gitea" "gitea" "gitea-vault" \
 write_policy_and_role "vaultwarden" "vaultwarden" "vaultwarden-vault" \
   "vaultwarden/* shared/postmark-relay" ""
 write_policy_and_role "sso" "sso" "sso-vault,sso-vault-sync,mas-secrets-ensure" \
-  "sso/* shared/keycloak-admin shared/portal-e2e-client shared/postmark-relay harbor-pull/sso" ""
+  "sso/* portal/bstein-dev-home-keycloak-admin shared/keycloak-admin shared/portal-e2e-client shared/postmark-relay harbor-pull/sso" ""
 write_policy_and_role "mailu-mailserver" "mailu-mailserver" "mailu-vault-sync" \
   "mailu/* shared/postmark-relay harbor-pull/mailu-mailserver" ""
 write_policy_and_role "harbor" "harbor" "harbor-vault-sync" \