diff --git a/credential-change-requests/CCR-2026-0033.yaml b/credential-change-requests/CCR-2026-0033.yaml
index 7f317d8..bc6723c 100644
--- a/credential-change-requests/CCR-2026-0033.yaml
+++ b/credential-change-requests/CCR-2026-0033.yaml
@@ -61,6 +61,7 @@ openbao:
   policy_name: workload-kv-read-keycape-secrets-engine-openbao-eso
   policy_file: openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
   metadata_read: false
+  token_self_lifecycle: true
   auth:
     method: kubernetes
     mount: kubernetes
diff --git a/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
index b07a283..64df36f 100644
--- a/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
+++ b/openbao/policies/workload-kv-read-keycape-secrets-engine-openbao-eso.hcl
@@ -1,3 +1,12 @@
 path "platform/data/workloads/keycape/secrets-engine-openbao" {
   capabilities = ["read"]
 }
+
+# ESO validates its own short-lived workload session.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}