diff --git a/hosts/hetzner-arm/containers/vault-ca/default.nix b/hosts/hetzner-arm/containers/vault-ca/default.nix
index 6a0eebf..9a56240 100644
--- a/hosts/hetzner-arm/containers/vault-ca/default.nix
+++ b/hosts/hetzner-arm/containers/vault-ca/default.nix
@@ -16,6 +16,7 @@ in {
     privateNetwork = true;
     hostAddress = hostIP;
     localAddress = containerIP;
+    additionalCapabilities = [ "CAP_IPC_LOCK" ];
 
     specialArgs = {
       inherit inputs;