diff --git a/kubernetes/namespaces/bots/bot/deployment.yaml b/kubernetes/namespaces/bots/bot/deployment.yaml
index d61d3ad2..0ab8e5be 100644
--- a/kubernetes/namespaces/bots/bot/deployment.yaml
+++ b/kubernetes/namespaces/bots/bot/deployment.yaml
@@ -17,6 +17,8 @@ spec:
         fsGroup: 2000
         runAsUser: 1000
         runAsNonRoot: true
+      serviceAccountName: bot
+      automountServiceAccountToken: false
       containers:
       - name: bot
         image: ghcr.io/python-discord/bot:latest
@@ -40,6 +42,9 @@ spec:
           name: logs-vol
         - mountPath: /.cache/python-tldextract
           name: tldextract-cache
+        - mountPath: /var/run/secrets/polonium-api
+          name: polonium-api-token
+          readOnly: true
         securityContext:
           readOnlyRootFilesystem: true
       volumes:
@@ -47,3 +52,10 @@ spec:
         emptyDir: {}
       - name: tldextract-cache
         emptyDir: {}
+      - name: polonium-api-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: external-read
+              expirationSeconds: 600
diff --git a/kubernetes/namespaces/bots/bot/service-account.yaml b/kubernetes/namespaces/bots/bot/service-account.yaml
new file mode 100644
index 00000000..93f39fe7
--- /dev/null
+++ b/kubernetes/namespaces/bots/bot/service-account.yaml
@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bot
+  namespace: bots
diff --git a/kubernetes/namespaces/modmail/secrets.yaml b/kubernetes/namespaces/modmail/secrets.yaml
index 96148274..4bef758a 100644
Binary files a/kubernetes/namespaces/modmail/secrets.yaml and b/kubernetes/namespaces/modmail/secrets.yaml differ