diff --git a/clusters/wb/infrastructure/patches/istio-config.yaml b/clusters/wb/infrastructure/patches/istio-config.yaml
index 1f91b3b..4fa371e 100644
--- a/clusters/wb/infrastructure/patches/istio-config.yaml
+++ b/clusters/wb/infrastructure/patches/istio-config.yaml
@@ -71,6 +71,16 @@ spec:
                     - vmalert-srx.wb.ru
                   tls:
                     credentialName: istio-gateway-wildcard-cert
+            vault:
+              name: vault-gw
+              namespace: gateway
+              selector:
+                istio: ingressgateway
+              servers:
+                - hosts:
+                    - vault-srx.wb.ru
+                  tls:
+                    credentialName: istio-gateway-wildcard-cert
           virtualServices:
             gitea-vs:
               namespace: gitea
@@ -127,3 +137,14 @@ spec:
                     prefix: /
                   service: goalert.goalert.svc.cluster.local
                   port: 8081
+            vault-vs:
+              namespace: vault
+              hosts:
+                - vault-srx.wb.ru
+              gateways:
+                - gateway/vault-gw
+              routes:
+                - path:
+                    prefix: /
+                  service: vault-vault-contour-active.vault.svc.cluster.local
+                  port: 8200