diff --git a/go/provisions/provisions.go b/go/provisions/provisions.go
index ca8d914..1e7a4fb 100644
--- a/go/provisions/provisions.go
+++ b/go/provisions/provisions.go
@@ -131,8 +131,11 @@ const VaultModule = "mesh-vault"
 // CredentialKey is the key of a provision's credential, itself a provision whose provider is the vault (clause 6; the
 // key form the lead settled on 2026-10-29): `<consumer node>.<consumer>.secret-<provision>[.<local>]` for a value of the
 // consumer's own (pair, issued, given), and `<provider node>.<provider>.secret-<provision>` for the provider's one
-// shared value. False for a form with no vault value.
+// shared value. False for a form with no vault value, and for a provision the vault itself provides.
 func CredentialKey(form string, consumer, provider End, provision, local string) (string, bool) {
+	if provider.Module == VaultModule {
+		return "", false // the vault's own offer is the value: it has no credential beside it (the lead, 2026-10-29)
+	}
 	name := catalogue.CredentialProvisionPrefix + provision
 	switch form {
 	case FormPair, FormIssued, FormGiven:
diff --git a/go/provisions/provisions_test.go b/go/provisions/provisions_test.go
index e0ba87a..37a9796 100644
--- a/go/provisions/provisions_test.go
+++ b/go/provisions/provisions_test.go
@@ -104,6 +104,11 @@ func TestAProvisionIsAReferenceUnderItsConsumersKey(t *testing.T) {
 			t.Errorf("%q depends on %q, want %q", c.form, got, c.want)
 		}
 	}
+	// The vault's own offer is the value: no secret-secret beside it.
+	vaultEntry := catalogue.PlanProvision{Provision: "secret", Provider: "novox", ProviderModule: VaultModule, CredentialForm: FormPair}
+	if got := DependsOn(keycloak, vaultEntry, nil); len(got) != 0 {
+		t.Errorf("the vault's secret depends on %v", got)
+	}
 	if _, err := catalogue.ParseManifest([]byte(`{"module":"x","version":"1","provides":[{"name":"secret-db","scope":"mesh"}]}`)); err == nil ||
 		!strings.Contains(err.Error(), "secret-") {
 		t.Errorf("a provision named secret-*: %v", err)