diff --git a/assets/dashy-soc-board-vault-panel.png b/assets/dashy-soc-board-vault-panel.png
new file mode 100644
index 0000000..3b2e704
Binary files /dev/null and b/assets/dashy-soc-board-vault-panel.png differ
diff --git a/docs/dashy-soc-board.md b/docs/dashy-soc-board.md
index e59c007..0a56414 100644
--- a/docs/dashy-soc-board.md
+++ b/docs/dashy-soc-board.md
@@ -59,6 +59,10 @@ This is the real board, not a mockup of the layout — the dependency ladder, th
 
 ![The real SOC Board: a 6-tier dependency ladder and fleet-wide Wazuh KPIs on top, an Active Issues strip below that, then a grid of per-host tiles with severity badges and 24h error sparklines](../assets/dashy-soc-board.png)
 
+Clicking through to one of those "folded-in specialty widgets" — the Vault seal-state panel, expanded on the secrets host's own tile:
+
+![The Vault tile expanded: UNSEALED banner, active lease/token/KV-secret/secret-engine counts, token TTL distribution, and PKI CA cert expiry for both mounts, alongside that host's own Wazuh findings by category](../assets/dashy-soc-board-vault-panel.png)
+
 > [!TIP]
 > **Deliberately scoped**: security/error/warning signal only. Per-app uptime is handled separately by Dashy's own native status checks on individual tiles — the only up/down signal inside this board is *infrastructure-tier* reachability from Prometheus, not per-app availability. Keeping the scope narrow — resisting the temptation to also make this the uptime dashboard — is what keeps the board actually scannable instead of turning into a second copy of Grafana.