diff --git a/policies/smtp-healthcheck-ro.hcl b/policies/smtp-healthcheck-ro.hcl
new file mode 100644
index 0000000..a106870
--- /dev/null
+++ b/policies/smtp-healthcheck-ro.hcl
@@ -0,0 +1,6 @@
+# Read-only access to the SMTP credentials used by the ClaudeAdmin healthcheck
+# email notifier (run-healthcheck.sh). Scoped to exactly one KV v2 path.
+# Consumed via a periodic token at ~/.config/openbao/healthcheck-smtp.token.
+path "secret/data/smtp/healthcheck" {
+  capabilities = ["read"]
+}