diff --git a/vault/secret-store.yaml b/vault/secret-store.yaml
index e15236d..e2deb5a 100644
--- a/vault/secret-store.yaml
+++ b/vault/secret-store.yaml
@@ -5,7 +5,9 @@ metadata:
 spec:
   provider:
     vault:
-      server: "https://vault.rubenhensen.nl"
+      # In-cluster, so syncing secrets doesn't depend on Hetzner or the home
+      # internet connection. Plain HTTP, like the ingress → Vault hop.
+      server: "http://vault-active.vault.svc:8200"
       path: "kv"
       # Version is the Vault KV secret engine version.
       # This can be either "v1" or "v2", defaults to "v2"