diff --git a/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl b/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
new file mode 100644
index 00000000..b7b1eb2a
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
@@ -0,0 +1,10 @@
+# OpenBao policy: ssh-sign-claude
+# Sign claude-bot's SSH public key on ssh-client-signer role claude (1h certs). Attached to userpass user claude-bot. NOT applied by Flux.
+#
+#   bao write ssh-client-signer/roles/claude @kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
+#   bao policy write ssh-sign-claude kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
+#   bao write auth/userpass/users/claude-bot token_policies=claude-bot-write,ssh-sign-claude
+
+path "ssh-client-signer/sign/claude" {
+  capabilities = ["update"]
+}
diff --git a/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json b/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
new file mode 100644
index 00000000..9ed47629
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
@@ -0,0 +1,12 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "claude-bot",
+  "default_user": "claude-bot",
+  "allowed_extensions": "permit-pty",
+  "default_extensions": {
+    "permit-pty": ""
+  },
+  "ttl": "1h",
+  "max_ttl": "1h"
+}
diff --git a/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json b/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json
new file mode 100644
index 00000000..998cec49
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json
@@ -0,0 +1,14 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "k.renner",
+  "default_user": "k.renner",
+  "allowed_extensions": "permit-pty,permit-port-forwarding,permit-agent-forwarding,permit-user-rc",
+  "default_extensions": {
+    "permit-pty": "",
+    "permit-port-forwarding": "",
+    "permit-user-rc": ""
+  },
+  "ttl": "4380h",
+  "max_ttl": "4380h"
+}