diff --git a/servers/gcp/cloud-sql.tf b/servers/gcp/cloud-sql.tf
index 12cefec..abd17ef 100644
--- a/servers/gcp/cloud-sql.tf
+++ b/servers/gcp/cloud-sql.tf
@@ -236,6 +236,24 @@ resource "google_secret_manager_secret_iam_member" "gitea_db_password_accessor"
   member    = "serviceAccount:${google_service_account.gitea.email}"
 }
 
+# ESO Workload Identity — allows the external-secrets controller SA on GKE
+# to impersonate the gitea GCP SA for Secret Manager access.
+resource "google_service_account_iam_member" "eso_gitea_wi" {
+  service_account_id = google_service_account.gitea.name
+  role               = "roles/iam.workloadIdentityUser"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]"
+
+  depends_on = [google_container_cluster.neuron_platform]
+}
+
+resource "google_service_account_iam_member" "eso_gitea_token_creator" {
+  service_account_id = google_service_account.gitea.name
+  role               = "roles/iam.serviceAccountTokenCreator"
+  member             = "serviceAccount:${var.project_id}.svc.id.goog[external-secrets/external-secrets]"
+
+  depends_on = [google_container_cluster.neuron_platform]
+}
+
 output "gitea_service_account_email" {
   description = "Gitea GKE SA email — used in the Workload Identity annotation"
   value       = google_service_account.gitea.email
diff --git a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
index 8f2f051..019e0b1 100644
--- a/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
+++ b/servers/gcp/k8s/argocd-apps/vault-helm-gke.yaml
@@ -90,7 +90,7 @@ spec:
           topologySpreadConstraints:
             - maxSkew: 1
               topologyKey: topology.kubernetes.io/zone
-              whenUnsatisfiable: DoNotSchedule
+              whenUnsatisfiable: ScheduleAnyway
               labelSelector:
                 matchLabels:
                   app.kubernetes.io/name: vault