diff --git a/terraform/keycloak/main.tf b/terraform/keycloak/main.tf
index 44956f5..7d87b28 100644
--- a/terraform/keycloak/main.tf
+++ b/terraform/keycloak/main.tf
@@ -204,6 +204,34 @@ resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
   ]
 }
 
+# A single machine identity shared by the host-level Vector agents. The secret
+# is generated by Keycloak and delivered to Nix hosts through sops-nix.
+resource "keycloak_openid_client" "tsunagi_vector" {
+  realm_id                     = keycloak_realm.hexor.id
+  client_id                    = "tsunagi-vector"
+  name                         = "tsunagi Vector log writer"
+  enabled                      = true
+  access_type                  = "CONFIDENTIAL"
+  standard_flow_enabled        = false
+  direct_access_grants_enabled = false
+  service_accounts_enabled     = true
+  access_token_lifespan        = "600"
+}
+
+# Handoff to the Nix sops secret. Terraform CI has the generated Keycloak
+# credential; the operator can read this Secret and encrypt it for the hosts.
+resource "kubernetes_secret_v1" "tsunagi_vector_client" {
+  metadata {
+    name      = "tsunagi-vector-client"
+    namespace = "keycloak"
+  }
+
+  data = {
+    client_id     = keycloak_openid_client.tsunagi_vector.client_id
+    client_secret = keycloak_openid_client.tsunagi_vector.client_secret
+  }
+}
+
 # =============================================================================
 # Proxy applications — auto-created groups + routes ConfigMap
 # =============================================================================
@@ -298,11 +326,21 @@ resource "kubernetes_config_map_v1" "auth_proxy_routes" {
 
   data = {
     "routes.yaml" = yamlencode({
-      routes = {
+      routes = merge({
         for k, v in var.proxy_applications : v.domain => {
           allowed_groups = local.app_allowed_groups[k]
         }
-      }
+        }, {
+        "loki.hexor.cy" = {
+          browser_access = false
+          allowed_groups = []
+          machine_access = {
+            client_ids = [keycloak_openid_client.tsunagi_vector.client_id]
+            method     = "POST"
+            path       = "/loki/api/v1/push"
+          }
+        }
+      })
     })
   }
 }
diff --git a/terraform/keycloak/outputs.tf b/terraform/keycloak/outputs.tf
index 239628b..ffbdafb 100644
--- a/terraform/keycloak/outputs.tf
+++ b/terraform/keycloak/outputs.tf
@@ -15,6 +15,11 @@ output "rsauth2_proxy_client_secret" {
   sensitive = true
 }
 
+output "tsunagi_vector_client_secret" {
+  value     = keycloak_openid_client.tsunagi_vector.client_secret
+  sensitive = true
+}
+
 output "standalone_groups" {
   value = [for g in keycloak_group.standalone : g.name]
 }