diff --git a/terranix/containers/gitea/default.nix b/terranix/containers/gitea/default.nix
index 83f0954..3b6b875 100644
--- a/terranix/containers/gitea/default.nix
+++ b/terranix/containers/gitea/default.nix
@@ -24,7 +24,7 @@ in
   resource."vault_policy"."gitea-policy" = {
     name = "gitea-policy";
     policy = ''
-      path "kv/data/gitea" {
+      path "kv/data/cluster/gitea/gitea" {
         capabilities = ["read"]
       }
     '';
diff --git a/terranix/containers/gitea/job.hcl b/terranix/containers/gitea/job.hcl
index 66c4e6e..9bcf600 100644
--- a/terranix/containers/gitea/job.hcl
+++ b/terranix/containers/gitea/job.hcl
@@ -109,28 +109,28 @@ job "gitea" {
 
       template {
         data = <<EOF
-{{ with secret "kv/data/gitea" }}{{ .Data.data.secret_key }}{{ end }}
+{{ with secret "kv/data/cluster/gitea/gitea" }}{{ .Data.data.secret_key }}{{ end }}
 EOF
         destination = "secrets/secret_key"
       }
 
       template {
         data = <<EOF
-{{ with secret "kv/data/gitea" }}{{ .Data.data.internal_token }}{{ end }}
+{{ with secret "kv/data/cluster/gitea/gitea" }}{{ .Data.data.internal_token }}{{ end }}
 EOF
         destination = "secrets/internal_token"
       }
 
       template {
         data = <<EOF
-{{ with secret "kv/data/gitea" }}{{ .Data.data.jwt_secret }}{{ end }}
+{{ with secret "kv/data/cluster/gitea/gitea" }}{{ .Data.data.jwt_secret }}{{ end }}
 EOF
         destination = "secrets/jwt_secret"
       }
 
       template {
         data = <<EOF
-{{ with secret "kv/data/gitea" }}{{ .Data.data.lfs_jwt_secret }}{{ end }}
+{{ with secret "kv/data/cluster/gitea/gitea" }}{{ .Data.data.lfs_jwt_secret }}{{ end }}
 EOF
         destination = "secrets/lfs_jwt_secret"
       }