diff --git a/infrastructure/authentik/vault-blueprint.yaml b/infrastructure/authentik/vault-blueprint.yaml
index aeb6a7e..ddcbc43 100644
--- a/infrastructure/authentik/vault-blueprint.yaml
+++ b/infrastructure/authentik/vault-blueprint.yaml
@@ -45,6 +45,15 @@ spec:
                 redirect_uris:
                   - url: "https://vault.kube.huskypup.net/ui/vault/auth/oidc/oidc/callback"
                     matching_mode: strict
+                  # VPS's own standby Vault instance (infrastructure/vps-standby/vault/)
+                  # shares this SAME Authentik provider/client_id - found missing
+                  # 2026-08-21 while testing VPS vault login ("missing auth_url" -
+                  # Vault silently returns no auth_url when the UI's computed
+                  # redirect_uri isn't in allowed_redirect_uris; same fix needed on
+                  # the VPS Vault's own auth/oidc/role/default, done separately since
+                  # it's a fully independent Vault instance/backend).
+                  - url: "https://vault.vps.huskypup.net/ui/vault/auth/oidc/oidc/callback"
+                    matching_mode: strict
                   - url: "http://localhost:8250/oidc/callback"
                     matching_mode: strict
                 property_mappings: