# Tenzir Platform v1.26.0

This release adds HashiCorp Vault as an external secret store for workspaces. The integration supports token and AppRole authentication with the KV v2 secrets engine.

## 🚀 Features

### HashiCorp Vault secret store support

Dec 23, 2025 · [@lava](https://github.com/lava), [@mavam](https://github.com/mavam)

You can now use HashiCorp Vault as an external secret store for your workspaces. The integration supports token and AppRole authentication methods, and works with the KV v2 secrets engine. Add a Vault secret store via the CLI:

```bash
tenzir-platform secret store add vault \
  --address=https://vault.example.com \
  --mount=secret \
  --token=<token>
```

Or with AppRole authentication (recommended for production):

```bash
tenzir-platform secret store add vault \
  --address=https://vault.example.com \
  --mount=secret \
  --role-id=<id> --secret-id=<id>
```

The `--mount` option specifies the path to a KV v2 secrets engine. For Vault Enterprise, use `--namespace` to specify the namespace. Vault secrets are returned as JSON by default. Append a `:key` suffix to retrieve a specific field as a string, for example, `secret("database:password")`.

### Custom gateway URL in deployment instructions

Dec 22, 2025 · [@lava](https://github.com/lava)

When using a Sovereign Edition instance of the Tenzir Platform with a custom Tenzir Gateway URL, the “Other” tab now displays the gateway endpoint for easy copying.

[ Download on GitHub ](https://github.com/tenzir/platform/releases/tag/v1.26.0)

[Get the release artifacts and source code.](https://github.com/tenzir/platform/releases/tag/v1.26.0)