diff --git a/internal/util/crypto.go b/internal/util/crypto.go
index 8e1f6af35..7b0c61e70 100644
--- a/internal/util/crypto.go
+++ b/internal/util/crypto.go
@@ -138,7 +138,7 @@ func GetKMS(tenant, kmsID string, secrets map[string]string) (EncryptionKMS, err
 	}
 
 	switch kmsType {
-	case "vault":
+	case kmsTypeVault:
 		return InitVaultKMS(kmsID, kmsConfig, secrets)
 	case kmsTypeVaultTokens:
 		return InitVaultTokensKMS(tenant, kmsID, kmsConfig, secrets)
diff --git a/internal/util/vault.go b/internal/util/vault.go
index fca1f3b6f..ec08df756 100644
--- a/internal/util/vault.go
+++ b/internal/util/vault.go
@@ -31,6 +31,8 @@ import (
 )
 
 const (
+	kmsTypeVault = "vault"
+
 	// path to service account token that will be used to authenticate with Vault
 	// #nosec
 	serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"