diff --git a/clusters/yc-infra-prod/infrastructure/patches/vault-unseal.yaml b/clusters/yc-infra-prod/infrastructure/patches/vault-unseal.yaml
index e9d7a6e..5965a77 100644
--- a/clusters/yc-infra-prod/infrastructure/patches/vault-unseal.yaml
+++ b/clusters/yc-infra-prod/infrastructure/patches/vault-unseal.yaml
@@ -22,7 +22,49 @@ spec:
     injector:
       enabled: false
     server:
+      includeConfigAnnotation: true
       ha:
         replicas: 3
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
+              }
+            }
+
+            {{- if .Values.autounseal.enabled }}
+            seal "transit" {
+              address         = "{{ .Values.autounseal.transit.address }}"
+              token           = "env://VAULT_TOKEN"
+              key_name        = "{{ .Values.autounseal.transit.keyName }}"
+              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
+              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
+              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
+            }
+            {{- end }}
+
+            service_registration "kubernetes" {}
+
+            telemetry {
+              prometheus_retention_time = "30s"
+              disable_hostname = true
+            }
       dataStorage:
         size: 10Gi
diff --git a/clusters/yc-infra-prod/infrastructure/patches/vault.yaml b/clusters/yc-infra-prod/infrastructure/patches/vault.yaml
index 7f677b0..679bdf5 100644
--- a/clusters/yc-infra-prod/infrastructure/patches/vault.yaml
+++ b/clusters/yc-infra-prod/infrastructure/patches/vault.yaml
@@ -29,7 +29,49 @@ spec:
         endpoint: "https://storage.yandexcloud.net"
         prefix: "vault/yc-infra-prod/raft-snapshots"
     server:
+      includeConfigAnnotation: true
       dataStorage:
         size: 20Gi
       ha:
         replicas: 3
+        raft:
+          config: |
+            ui = true
+
+            listener "tcp" {
+              tls_disable = 1
+              address = "[::]:8200"
+              cluster_address = "[::]:8201"
+            }
+
+            storage "raft" {
+              path = "/vault/data"
+
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
+              }
+              retry_join {
+                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
+              }
+            }
+
+            {{- if .Values.autounseal.enabled }}
+            seal "transit" {
+              address         = "{{ .Values.autounseal.transit.address }}"
+              token           = "env://VAULT_TOKEN"
+              key_name        = "{{ .Values.autounseal.transit.keyName }}"
+              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
+              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
+              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
+            }
+            {{- end }}
+
+            service_registration "kubernetes" {}
+
+            telemetry {
+              prometheus_retention_time = "30s"
+              disable_hostname = true
+            }