diff --git a/packages/api/agent_vault.go b/packages/api/agent_vault.go
index 74f5e417c..08afad16d 100644
--- a/packages/api/agent_vault.go
+++ b/packages/api/agent_vault.go
@@ -239,9 +239,9 @@ func CallCreateAgentVaultSessionLogChunk(ctx context.Context, httpClient *resty.
 }
 
 type CreateAgentVaultSessionRequest struct {
-	AccessBundles []string `json:"accessBundles"`
-	TTL           string   `json:"ttl"`
-	Label         string   `json:"label,omitempty"`
+	AccessBundle string `json:"accessBundle"`
+	TTL          string `json:"ttl"`
+	Label        string `json:"label,omitempty"`
 }
 
 type AgentVaultSession struct {
diff --git a/packages/api/agent_vault_test.go b/packages/api/agent_vault_test.go
index e9b2fd570..b7d0045ea 100644
--- a/packages/api/agent_vault_test.go
+++ b/packages/api/agent_vault_test.go
@@ -58,7 +58,7 @@ func TestAgentVaultCredentialCallsRefuseAnOversizedBody(t *testing.T) {
 
 func TestCreateAgentVaultSessionRequestSendsALabelOnlyWhenGiven(t *testing.T) {
 	// Without --label the request body stays exactly what it was before sessions had labels.
-	unlabeled, err := json.Marshal(CreateAgentVaultSessionRequest{AccessBundles: []string{"coding-agent"}, TTL: "never"})
+	unlabeled, err := json.Marshal(CreateAgentVaultSessionRequest{AccessBundle: "coding-agent", TTL: "never"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -66,7 +66,7 @@ func TestCreateAgentVaultSessionRequestSendsALabelOnlyWhenGiven(t *testing.T) {
 		t.Errorf("want no label key, got %s", unlabeled)
 	}
 
-	labeled, err := json.Marshal(CreateAgentVaultSessionRequest{AccessBundles: []string{"coding-agent"}, TTL: "never", Label: "nightly deploy"})
+	labeled, err := json.Marshal(CreateAgentVaultSessionRequest{AccessBundle: "coding-agent", TTL: "never", Label: "nightly deploy"})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/packages/cmd/agent_vault_run.go b/packages/cmd/agent_vault_run.go
index 5f88aa58b..b313a56a3 100644
--- a/packages/cmd/agent_vault_run.go
+++ b/packages/cmd/agent_vault_run.go
@@ -419,7 +419,7 @@ func runAgentVaultRun(cmd *cobra.Command, args []string) {
 		}
 		httpClient.SetAuthToken(identity)
 
-		created, mintErr := api.CallCreateAgentVaultSession(httpClient, api.CreateAgentVaultSessionRequest{AccessBundles: accessBundles, TTL: ttl, Label: label})
+		created, mintErr := api.CallCreateAgentVaultSession(httpClient, api.CreateAgentVaultSessionRequest{AccessBundle: accessBundles[0], TTL: ttl, Label: label})
 		if mintErr != nil {
 			util.HandleError(mintErr, "Unable to mint an Agent Vault session")
 		}