diff --git a/charts/flex-auth/templates/deployment.yaml b/charts/flex-auth/templates/deployment.yaml
index 3afef53..8a26fb4 100644
--- a/charts/flex-auth/templates/deployment.yaml
+++ b/charts/flex-auth/templates/deployment.yaml
@@ -26,6 +26,9 @@ metadata:
   name: {{ include "flex-auth.name" . }}
   labels:
     {{- include "flex-auth.labels" . | nindent 4 }}
+    {{- with .Values.releaseUnit }}
+    railiance.io/release-unit: {{ . | quote }}
+    {{- end }}
 spec:
   {{- if .Values.outbox.enabled }}
   {{- $replicas := .Values.replicaCount }}
diff --git a/registry/release-units/flex-auth-secrets-engine.yaml b/registry/release-units/flex-auth-secrets-engine.yaml
new file mode 100644
index 0000000..e2dda95
--- /dev/null
+++ b/registry/release-units/flex-auth-secrets-engine.yaml
@@ -0,0 +1,46 @@
+# Source digest is the commit this declaration was written against.
+kind: release-unit
+unit_id: flex-auth-secrets-engine
+owner: access-engine
+contract_version: "1.0.0"
+data_classification: restricted
+criticality: high
+composition:
+  purpose: "Decides secrets-engine policy for one flex-auth consumer."
+  member_repos:
+    - repo: access-engine
+      role: application source
+      deployables:
+        - flex-auth-secrets-engine
+rollout_contract:
+  default_mode: helm-upgrade-install
+smoke_contract:
+  required:
+    - http-ready
+rollback_contract:
+  order:
+    - helm-rollback
+workloads:
+  - kind: Deployment
+    namespace: flex-auth
+    name: flex-auth-secrets-engine
+pins:
+  component:
+    name: ocm.railiance.dev/flex-auth-secrets-engine
+    version: "0.2.0"
+  resources:
+    - name: flex-auth
+      type: ociImage
+      version: "0.2.0"
+      digest:
+        hashAlgorithm: SHA-256
+        normalisationAlgorithm: ociArtifactDigest/v1
+        value: "sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd"
+  sources:
+    - name: access-engine
+      type: git
+      version: "0.2.0"
+      digest:
+        hashAlgorithm: SHA-1
+        normalisationAlgorithm: gitCommit/v1
+        value: "0344b2a962e4ed977ea622b08cf20bf49d25b603"
diff --git a/values/secrets-engine.yaml b/values/secrets-engine.yaml
index 391eff9..21c26e3 100644
--- a/values/secrets-engine.yaml
+++ b/values/secrets-engine.yaml
@@ -1,5 +1,7 @@
 # Dedicated secrets-engine policy service; CI build dd8dd517438b876fdadf27770e3f7e7f55ea69cf.
 name: flex-auth-secrets-engine
+# Only this release claims the unit. Other flex-auth pins leave the label unset.
+releaseUnit: flex-auth-secrets-engine
 image:
   repository: forgejo.coulomb.social/coulomb/flex-auth
   digest: sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd