diff --git a/k8s/bases/infrastructure/vault-config/job.yaml b/k8s/bases/infrastructure/vault-config/job.yaml
index 8cbd8d167..23af31616 100644
--- a/k8s/bases/infrastructure/vault-config/job.yaml
+++ b/k8s/bases/infrastructure/vault-config/job.yaml
@@ -841,6 +841,9 @@ spec:
               path "secret/data/infrastructure/ghcr/*" {
                 capabilities = ["create", "update", "read"]
               }
+              path "secret/data/infrastructure/velero/*" {
+                capabilities = ["create", "update", "read"]
+              }
               path "secret/data/apps/fleetdm/*" {
                 capabilities = ["create", "update", "read"]
               }
diff --git a/k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml b/k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml
index 4d10322cb..0300149cc 100644
--- a/k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml
+++ b/k8s/bases/infrastructure/vault-seed/push-secret-seed-velero-repo-credentials.yaml
@@ -7,7 +7,8 @@
 # unrecoverable -- even if the R2 bucket is intact.
 #
 # This PushSecret one-way mirrors the password to OpenBao at
-# infrastructure/backup/velero-repo so it survives a cluster rebuild.
+# infrastructure/velero/repo so it survives a cluster rebuild without
+# sharing the broadly readable backup-object credential prefix.
 # OpenBao durability today comes from Velero snapshotting the openbao
 # namespace (including its PVC) to R2 on the daily schedule -- the
 # password lands in the off-cluster backup alongside every other
@@ -35,5 +36,5 @@ spec:
     - match:
         secretKey: repository-password
         remoteRef:
-          remoteKey: infrastructure/backup/velero-repo
+          remoteKey: infrastructure/velero/repo
           property: repository-password