diff --git a/scripts/attended-mint-tenant-engine-sender.sh b/scripts/attended-mint-tenant-engine-sender.sh
new file mode 100755
index 0000000..28c9586
--- /dev/null
+++ b/scripts/attended-mint-tenant-engine-sender.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Parent-env wrapper for the attended tenant-engine sender mint.
+#
+# `warden access` runs OIDC from the *caller* environment, not from the
+# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
+# the wrong address and fails before the mint script starts.
+set -euo pipefail
+export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
+export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
+export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
+export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
+cd "$(dirname "$0")/.."
+exec warden access openbao-platform-admin-login --exec -- \
+  env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
+      BAO_ADDR="$BAO_ADDR" \
+      VAULT_ADDR="$VAULT_ADDR" \
+  "$PWD/scripts/mint-tenant-engine-sender.py"