diff --git a/terraform/vault/main.tf b/terraform/vault/main.tf
index 9490fe9..2d372c4 100644
--- a/terraform/vault/main.tf
+++ b/terraform/vault/main.tf
@@ -16,7 +16,7 @@ provider "vault" {
   token = var.vault_token
 
   dynamic "auth_login_oidc" {
-    for_each = var.vault_token == "" ? ["default"] : []
+    for_each = toset(var.vault_token == "" ? ["default"] : [])
 
     content {
       role = auth_login_oidc.value