# Nomad Workload Identity: How to avoid adding consul {} to hundreds of existing Nomad jobs?

**URL:** <https://discuss.hashicorp.com/t/nomad-workload-identity-how-to-avoid-adding-consul-to-hundreds-of-existing-nomad-jobs/77065>\
**Category:** Nomad\
**Created:** [January 15, 2026, 10:26pm UTC](https://discuss.hashicorp.com/t/nomad-workload-identity-how-to-avoid-adding-consul-to-hundreds-of-existing-nomad-jobs/77065 "2026-01-15T22:26:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![naccaratocarolina](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/naccaratocarolina/32/46957_2.png) [@naccaratocarolina](https://discuss.hashicorp.com/u/naccaratocarolina)\
**Post date:** [January 15, 2026, 10:26pm UTC](https://discuss.hashicorp.com/t/nomad-workload-identity-how-to-avoid-adding-consul-to-hundreds-of-existing-nomad-jobs/77065/1 "2026-01-15T22:26:42Z")

</div>

Hi everyone,

I have an existing Nomad + Consul + Vault cluster running in production, and I’m currently working on enabling Consul ACLs (they were disabled until now). For reference, these are the versions I’m running:

- Nomad: v1.10.5
- Consul: v1.21.4
- Vault: v1.20.3

I followed this guide to enable Consul ACLs:

> **[Secure Consul | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/docs/secure)**
>
> This topic provides an overview of all the Consul functionalities that contribute to increase its security. You can control access to Consul with access control lists (ACLs), encrypt its network traffic with gossip encryption/TLS, configure SSO or...

After that, I followed this tutorial to configure Nomad → Consul integration with ACLs:

> **[Configure Consul ACL with Nomad Workload Identities | Nomad | HashiCorp...](https://developer.hashicorp.com/nomad/tutorials/integrate-consul/consul-acl)**
>
> Configure Consul ACL with Nomad Workload Identities and then run a Nomad job to verify workload access to the Consul key/value (KV) store.

So far, everything is working as expected. However, I noticed that jobs which access Consul via template blocks only work if I explicitly add a `consul {}` stanza to the job specification.  
This is a big problem for me, because I already have hundreds of jobs running in this cluster, and all of them interact with Consul. It would be very painful (and risky) to “lock down” Consul and then redeploy every single job just to add an empty consul {} block.

My question is:  
Is there a way to configure a default Consul audience / Workload Identity at the Nomad level (agent, namespace, or global configuration), so that jobs automatically get Consul credentials without requiring an explicit `consul {}` stanza in each job?

Any guidance or best practices for migrating an existing cluster to Consul ACLs without redeploying all jobs would be greatly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![hazard.2008](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/hazard.2008/32/44174_2.png) [@hazard.2008](https://discuss.hashicorp.com/u/hazard.2008)\
**Post date:** [March 16, 2026, 9:12pm UTC](https://discuss.hashicorp.com/t/nomad-workload-identity-how-to-avoid-adding-consul-to-hundreds-of-existing-nomad-jobs/77065/2 "2026-03-16T21:12:42Z")

</div>

Hi [naccaratocarolina](https://discuss.hashicorp.com/u/naccaratocarolina)!

Try to add to client (or server) nomad config this:

```auto
consul {
task_identity {
aud = [“consul.io”]
ttl = “1h”
}

```

> **[consul Block in Agent Configuration | Nomad | HashiCorp Developer](https://developer.hashicorp.com/nomad/docs/configuration/consul)**
>
> Configure Nomad server and client integration with Consul in the \`consul\` block of a Nomad agent configuration for service discovery and key-value integration. Configure cluster name, the Consul namespace, whether Nomad should advertize its services,...