diff --git a/.changeset/twelve-meals-smell.md b/.changeset/twelve-meals-smell.md
new file mode 100644
index 0000000000..a9d64823a3
--- /dev/null
+++ b/.changeset/twelve-meals-smell.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-vault-backend': patch
+---
+
+Use `express-promise-router` to catch errors properly.
+Add `403` error as a known one. It will now return a `NotAllowed` error.
diff --git a/plugins/vault-backend/src/service/VaultBuilder.ts b/plugins/vault-backend/src/service/VaultBuilder.ts
index b82a5802bb..788b90ff01 100644
--- a/plugins/vault-backend/src/service/VaultBuilder.ts
+++ b/plugins/vault-backend/src/service/VaultBuilder.ts
@@ -17,7 +17,8 @@
 import { Config } from '@backstage/config';
 import { InputError } from '@backstage/errors';
 import { Logger } from 'winston';
-import express, { Router } from 'express';
+import express from 'express';
+import Router from 'express-promise-router';
 import { VaultClient } from './vaultApi';
 import { TaskRunner, PluginTaskScheduler } from '@backstage/backend-tasks';
 import { errorHandler } from '@backstage/backend-common';
diff --git a/plugins/vault-backend/src/service/vaultApi.ts b/plugins/vault-backend/src/service/vaultApi.ts
index 785352fea8..ea588964dc 100644
--- a/plugins/vault-backend/src/service/vaultApi.ts
+++ b/plugins/vault-backend/src/service/vaultApi.ts
@@ -15,7 +15,7 @@
  */
 
 import { Config } from '@backstage/config';
-import { NotFoundError } from '@backstage/errors';
+import { NotAllowedError, NotFoundError } from '@backstage/errors';
 import fetch from 'node-fetch';
 import plimit from 'p-limit';
 import { getVaultConfig, VaultConfig } from '../config';
@@ -103,6 +103,8 @@ export class VaultClient implements VaultApi {
       return (await response.json()) as T;
     } else if (response.status === 404) {
       throw new NotFoundError(`No secrets found in path '${path}'`);
+    } else if (response.status === 403) {
+      throw new NotAllowedError(response.statusText);
     }
     throw new Error(
       `Unexpected error while fetching secrets from path '${path}'`,