diff --git a/cmd/gateway_lifecycle.go b/cmd/gateway_lifecycle.go
index 27f990d8..8d1a4b40 100644
--- a/cmd/gateway_lifecycle.go
+++ b/cmd/gateway_lifecycle.go
@@ -106,6 +106,22 @@ func (d *gatewayDeps) runLifecycle(
 		slog.Info("tts config reloaded", "provider", newMgr.PrimaryProvider(), "auto", string(newMgr.AutoMode()))
 	})
 
+	// Hot-swap vault enrichment provider/model on config changes via pub/sub.
+	if d.updateVaultProvider != nil {
+		d.msgBus.Subscribe("vault-enrich-config-reload", func(evt bus.Event) {
+			if evt.Name != bus.TopicConfigChanged {
+				return
+			}
+			updatedCfg, ok := evt.Payload.(*config.Config)
+			if !ok {
+				return
+			}
+			if p, m := resolveBackgroundProvider(updatedCfg, d.providerRegistry); p != nil {
+				d.updateVaultProvider(p, m)
+			}
+		})
+	}
+
 	// Log orphaned providers on agent deletion. Auto-delete is unsafe because
 	// providers can be referenced by heartbeats (FK), OAuth tokens, media chains.
 	d.msgBus.Subscribe("agent-deleted-provider-log", func(evt bus.Event) {