diff --git a/.vault/vault-keys b/.vault/vault-keys
index 9dddb9f..ae38c9d 100644
--- a/.vault/vault-keys
+++ b/.vault/vault-keys
@@ -1,4 +1 @@
-D749E2966193DF63
-EE3E0A7A87192BB7
-3C8D0C7EF49AB5A3
-388DD8D74903017E
+88CBCAD842520E46
diff --git a/.vault/vault-pass.gpg b/.vault/vault-pass.gpg
index 7b6b4dd..e743d3e 100644
Binary files a/.vault/vault-pass.gpg and b/.vault/vault-pass.gpg differ
diff --git a/files/manifests/secret-digitalocean-dns.yaml b/files/manifests/secret-digitalocean-dns.yaml
index 67cea84..784f633 100644
--- a/files/manifests/secret-digitalocean-dns.yaml
+++ b/files/manifests/secret-digitalocean-dns.yaml
@@ -1,12 +1,19 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
----
-apiVersion: v1
-data:
-  access-token: <base_64_encoded_digital_ocean_token>
-kind: Secret
-metadata:
-  name: digitalocean-dns
-  namespace: cert-manager
+$ANSIBLE_VAULT;1.1;AES256
+37303132393466333261633739343530323037363563346263393337306262386434616236623830
+6439616662356337653935346434323638326432363531660a333235636264313765646330363263
+31616232373735373834393965353930316161393265366431653639646438376534656462326337
+3036653763363530330a333461643731636535643532323139393238353431313034323066363635
+31336534383163303233383936383533663437663637323335326335356135653063303133643764
+35613638663736636166353734303333666332633434313766346332373565633166356561643030
+64626163636562323964346137313238633036396232393766393137663134396663613933646539
+63666435333763323862636536313436383133343031363232333433656264386139653030383465
+63333137356463303865393939303463333031383563393837623261333734353261326333316461
+66343135656631396230303665373033663431356464636163613333643362383162613861393435
+32626562653337313638623764646463663034363065306633346365303366643166633436643936
+32653865363631623839313533333831386339633837353233313730643939336265343764643131
+34363734616237373237303039643261376664376636386164643433366436353162656232336330
+39336436353235396633313265353939373262303637373830623439303132386666646130626330
+62653462343838303266343830366565666639353362343662653234396365353339343330623039
+37653335323564323762653338666634363237303830653736623963306564643831353233663630
+32386131373263613139326534633432666364656561663461643031663230643366363036336631
+3039393835346431346231636665396138393336343963333466
diff --git a/group_vars/all/vault.yml b/group_vars/all/vault.yml
index 2c89dcb..eb08362 100644
--- a/group_vars/all/vault.yml
+++ b/group_vars/all/vault.yml
@@ -1,2 +1,7 @@
----
-support_email: hello@audubon.app
+$ANSIBLE_VAULT;1.1;AES256
+37613532616632663366373332616133316237633564386464643032636137356436623331313365
+3164613836383930663466306133336263393764306662620a616131366561306334656535663432
+31323566373730353338356365663764386266383831666637646361626433343162313039343964
+3837666333343133630a343534366535613765336134623532323038633466666538356235323464
+65326264393765383138393661616537323864333036353130633461383865643030366363623437
+6162376537646461343066316234663730663466303931646630
diff --git a/group_vars/tnt_cad/k8s-vault.yml b/group_vars/tnt_cad/k8s-vault.yml
index fe6a7f4..de9db9b 100644
--- a/group_vars/tnt_cad/k8s-vault.yml
+++ b/group_vars/tnt_cad/k8s-vault.yml
@@ -1,4 +1,8 @@
----
-k8s_cluster_token: f63c34881f3d7fbd30229db4c92d902b
-
-# note: delete this file; it will be re-created when running `./roles/k8s/files/token-vault.sh ./group_vars/lx_cad/k8s-vault.yml`
+$ANSIBLE_VAULT;1.1;AES256
+32623937306230646432336339336134316263616136383264623030623930633664346263643165
+3539396565353163656432303038613736343430643765330a353465613136396436613565396638
+63396333363766353737363438383262623539376666316531303535663832303363356631633735
+6666643461626262350a393136306662666232356532366666323765356330333838363162356330
+61333233666634373666636630623865333838653762393634306464336636633633646266623263
+33373831613266373839383666326264376362646638386566656362656130383861633933666564
+383930616533303265633661363335633064