diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 19f36ca5..1289efdc 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -1034,6 +1034,11 @@ in
             *) bao auth enable cert ;;
           esac
 
+          case "$mounted" in
+            *'"approle/"'*) ;;
+            *) bao auth enable approle ;;
+          esac
+
           # `certificate=` is the CA, so this role trusts every leaf that
           # CA signed and `allowed_common_names` is the whole narrowing —
           # which is why ./swarm.nix reserves this subject as a hive name,