diff --git a/addons/api/addon/generated/models/credential-store.js b/addons/api/addon/generated/models/credential-store.js
index 8259b5609..47b39fbcd 100644
--- a/addons/api/addon/generated/models/credential-store.js
+++ b/addons/api/addon/generated/models/credential-store.js
@@ -117,4 +117,12 @@ export default class GeneratedCredentialStoreModel extends BaseModel {
     readOnly: true,
   })
   client_certificate_key_hmac;
+
+  @attr('string', {
+    for: 'vault',
+    isNestedAttribute: true,
+    description:
+      'Filters to the worker(s) who can handle Vault requests for this cred store.',
+  })
+  worker_filter;
 }
diff --git a/addons/api/mirage/factories/credential-store.js b/addons/api/mirage/factories/credential-store.js
index c59d9a44f..39337f230 100644
--- a/addons/api/mirage/factories/credential-store.js
+++ b/addons/api/mirage/factories/credential-store.js
@@ -42,6 +42,7 @@ export default factory.extend({
           token_hmac: 'token-hmac-abcde0987654321',
           client_certificate: 'client-cert-123',
           client_certificate_key_hmac: 'client-cert-key-hmac-abcde0987654321',
+          worker_filter: faker.random.words(),
         };
     }
   },
diff --git a/addons/api/tests/unit/serializers/credential-store-test.js b/addons/api/tests/unit/serializers/credential-store-test.js
index 205f5d388..77a9b6faf 100644
--- a/addons/api/tests/unit/serializers/credential-store-test.js
+++ b/addons/api/tests/unit/serializers/credential-store-test.js
@@ -20,6 +20,7 @@ module('Unit | Serializer | credential store', function (hooks) {
       tls_server_name: 'yes',
       tls_skip_verify: false,
       token: 'foo',
+      worker_filter: '"dev" in "/tags/type"',
       version: 1,
     });
     const snapshot = record._createSnapshot();
@@ -38,6 +39,7 @@ module('Unit | Serializer | credential store', function (hooks) {
         tls_server_name: 'yes',
         tls_skip_verify: false,
         token: 'foo',
+        worker_filter: '"dev" in "/tags/type"',
       },
     });
   });
@@ -62,6 +64,7 @@ module('Unit | Serializer | credential store', function (hooks) {
           tls_server_name: 'yes',
           tls_skip_verify: false,
           token: 'foo',
+          worker_filter: null,
           version: 1,
         },
       },
@@ -82,6 +85,7 @@ module('Unit | Serializer | credential store', function (hooks) {
         tls_server_name: 'yes',
         tls_skip_verify: false,
         token: 'foo',
+        worker_filter: null,
       },
       version: 1,
     });
@@ -99,6 +103,7 @@ module('Unit | Serializer | credential store', function (hooks) {
       tls_server_name: '',
       tls_skip_verify: false,
       type: 'vault',
+      worker_filter: '',
     });
     let serializedRecord = record.serialize();
     assert.deepEqual(serializedRecord, {
@@ -110,6 +115,7 @@ module('Unit | Serializer | credential store', function (hooks) {
         namespace: null,
         tls_server_name: null,
         tls_skip_verify: false,
+        worker_filter: null,
       },
       description: null,
       name: null,
@@ -130,6 +136,7 @@ module('Unit | Serializer | credential store', function (hooks) {
       tls_server_name: 'yes',
       tls_skip_verify: false,
       type: 'vault',
+      worker_filter: null,
     });
     let serializedRecord = record.serialize();
     assert.deepEqual(
@@ -143,6 +150,7 @@ module('Unit | Serializer | credential store', function (hooks) {
           namespace: 'foobar',
           tls_server_name: 'yes',
           tls_skip_verify: false,
+          worker_filter: null,
         },
         description: null,
         name: null,
@@ -164,6 +172,7 @@ module('Unit | Serializer | credential store', function (hooks) {
       namespace: 'foobar',
       tls_server_name: 'yes',
       tls_skip_verify: false,
+      worker_filter: null,
       type: 'vault',
     });
     let serializedRecord = record.serialize();
@@ -178,6 +187,7 @@ module('Unit | Serializer | credential store', function (hooks) {
           namespace: 'foobar',
           tls_server_name: 'yes',
           tls_skip_verify: false,
+          worker_filter: null,
         },
         description: null,
         name: null,
@@ -200,6 +210,7 @@ module('Unit | Serializer | credential store', function (hooks) {
           namespace: 'foobar',
           tls_server_name: 'yes',
           tls_skip_verify: false,
+          worker_filter: null,
         },
         description: null,
         name: null,