diff --git a/osac-installer/AGENTS.md b/osac-installer/AGENTS.md
index 9b2784d954..b8dc430291 100644
--- a/osac-installer/AGENTS.md
+++ b/osac-installer/AGENTS.md
@@ -118,7 +118,7 @@ Phase 3: charts/osac/                   # OSAC platform (per-instance workload)
     osac-ui (conditional: ui.enabled)
       -- a real external chart, via an oci:// reference pinned to a
       released version in Chart.yaml
-  Templates: hub-access, hooks (create-hub, pre-install-validate,
+  Templates: hub-access, bundled-openbao (conditional: bundledVault.enabled), hooks (create-hub, pre-install-validate,
     publish-templates, seed-cluster-versions, register-local-storage)
   values.schema.json validates all configuration
 ```
diff --git a/osac-installer/charts/osac/values.schema.json b/osac-installer/charts/osac/values.schema.json
index bebc4d5d2c..2e4580f926 100644
--- a/osac-installer/charts/osac/values.schema.json
+++ b/osac-installer/charts/osac/values.schema.json
@@ -1486,11 +1486,12 @@
         "enabled": {
           "type": "boolean",
           "description": "Deploy a bundled OpenBao instance for development/CI use",
-          "default": false
+          "default": true
         },
         "devRootToken": {
           "type": "string",
-          "description": "Root token for OpenBao dev mode (required when enabled)"
+          "description": "Root token for OpenBao dev mode (required when enabled)",
+          "default": "dev-root-token"
         },
         "image": {
           "type": "string",
diff --git a/osac-installer/charts/osac/values.yaml b/osac-installer/charts/osac/values.yaml
index 46b9f9de89..bc73b83981 100644
--- a/osac-installer/charts/osac/values.yaml
+++ b/osac-installer/charts/osac/values.yaml
@@ -329,8 +329,8 @@ hubAccess:
   enabled: false
 
 bundledVault:
-  enabled: false
-  devRootToken: ""
+  enabled: true
+  devRootToken: "dev-root-token"
   image: "ghcr.io/openbao/openbao:2.6.2"
   resources:
     limits:
diff --git a/osac-installer/docs/helm-deployment-guide.md b/osac-installer/docs/helm-deployment-guide.md
index 1acb54cffc..c0772f7521 100644
--- a/osac-installer/docs/helm-deployment-guide.md
+++ b/osac-installer/docs/helm-deployment-guide.md
@@ -109,13 +109,13 @@ Key settings:
 
 ## CI/Dev-Only Features
 
-These are top-level values, disabled by default. Enable only in CI/dev:
+These are top-level values for CI/dev use. Disable in production:
 
-| Value | What it does |
-|-------|-------------|
-| `hubAccess.enabled` | Creates hub-access SA/RBAC and registers local cluster as a hub. Only for environments where fulfillment-service and hub are the same cluster. |
-| `bundledPostgres.enabled` | Deploys a single-pod ephemeral PostgreSQL. Uses `fsync=off` and `emptyDir` — data lost on restart. Not for production. |
-| `bundledVault.enabled` | Deploys a single-pod ephemeral OpenBao (Vault-compatible) secret store for testing. Dev mode — data is lost on restart. Not for production. |
+| Value | Default | What it does |
+|-------|---------|-------------|
+| `hubAccess.enabled` | `false` | Creates hub-access SA/RBAC and registers local cluster as a hub. Only for environments where fulfillment-service and hub are the same cluster. |
+| `bundledPostgres.enabled` | `false` | Deploys a single-pod ephemeral PostgreSQL. Uses `fsync=off` and `emptyDir` — data lost on restart. Not for production. |
+| `bundledVault.enabled` | `true` | Deploys a single-pod ephemeral OpenBao (Vault-compatible) secret store for testing. Dev mode — data is lost on restart. Not for production. |
 
 ## Infrastructure Configuration
 
diff --git a/osac-installer/values/bmaas-ci/infra.yaml b/osac-installer/values/bmaas-ci/infra.yaml
index b8cf0299d1..3fefb8fbd1 100644
--- a/osac-installer/values/bmaas-ci/infra.yaml
+++ b/osac-installer/values/bmaas-ci/infra.yaml
@@ -34,10 +34,3 @@ bundledPostgres:
   database:
     name: service
     user: service
-
-# --- Bundled OpenBao ---
-# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode --
-# data is lost on restart. Not for production.
-bundledVault:
-  enabled: true
-  devRootToken: "dev-root-token"
diff --git a/osac-installer/values/caas-ci/infra.yaml b/osac-installer/values/caas-ci/infra.yaml
index f5fcb02f02..56f41d6496 100644
--- a/osac-installer/values/caas-ci/infra.yaml
+++ b/osac-installer/values/caas-ci/infra.yaml
@@ -40,10 +40,3 @@ bundledPostgres:
   enabled: true
   database:
     name: service
-
-# --- Bundled OpenBao ---
-# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode --
-# data is lost on restart. Not for production.
-bundledVault:
-  enabled: true
-  devRootToken: "dev-root-token"
diff --git a/osac-installer/values/dev/kind-instance.yaml b/osac-installer/values/dev/kind-instance.yaml
index fa758c5897..77bbb4cf0a 100644
--- a/osac-installer/values/dev/kind-instance.yaml
+++ b/osac-installer/values/dev/kind-instance.yaml
@@ -167,8 +167,3 @@ capiProvider:
 kafka:
   enabled: true
   replicas: 1
-
-# --- Vault compatible secret store (OpenBao) ---
-bundledVault:
-  enabled: true
-  devRootToken: "dev-root-token"
diff --git a/osac-installer/values/full-ci/infra.yaml b/osac-installer/values/full-ci/infra.yaml
index 37a20fb74f..73568f0a67 100644
--- a/osac-installer/values/full-ci/infra.yaml
+++ b/osac-installer/values/full-ci/infra.yaml
@@ -37,10 +37,3 @@ bundledPostgres:
   database:
     name: service
     user: service
-
-# --- Bundled OpenBao ---
-# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode --
-# data is lost on restart. Not for production.
-bundledVault:
-  enabled: true
-  devRootToken: "dev-root-token"
diff --git a/osac-installer/values/vmaas-ci/infra.yaml b/osac-installer/values/vmaas-ci/infra.yaml
index c6c8c25256..158ab04193 100644
--- a/osac-installer/values/vmaas-ci/infra.yaml
+++ b/osac-installer/values/vmaas-ci/infra.yaml
@@ -36,10 +36,3 @@ bundledPostgres:
   database:
     name: service
     user: service
-
-# --- Bundled OpenBao ---
-# Single-pod ephemeral Vault-compatible secret store for testing. Dev mode --
-# data is lost on restart. Not for production.
-bundledVault:
-  enabled: true
-  devRootToken: "dev-root-token"