diff --git a/k8s/secrets/agent-externalsecret.yaml b/k8s/secrets/agent-externalsecret.yaml
new file mode 100644
index 0000000..658b86f
--- /dev/null
+++ b/k8s/secrets/agent-externalsecret.yaml
@@ -0,0 +1,24 @@
+# The agents' Keycloak client secrets, for the workflows that act as those
+# agents. Read from the realm's own Vault entry through the keycloak store, not
+# copied into `n8n/*`: there is one source for a client secret, and rotating it
+# in Vault rotates it everywhere rather than leaving a stale twin behind.
+#
+# It is a narrow grant — this ExternalSecret names the properties it wants, so
+# the n8n namespace receives those and nothing else of the realm.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: n8n-agent-secrets
+  namespace: n8n
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-keycloak
+  target:
+    name: n8n-agent-secrets
+  data:
+    - secretKey: APPROVISIONNEMENT_CLIENT_SECRET
+      remoteRef:
+        key: keycloak/classic-models-realm
+        property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT