diff --git a/scripts/send-post.sh b/scripts/send-post.sh
index ee08631..d6c0a4f 100755
--- a/scripts/send-post.sh
+++ b/scripts/send-post.sh
@@ -2,19 +2,32 @@
 # Send one prepared post (pr-hall-of-helix/posts/<file>.yaml) through a
 # short-lived local adapter, then stop it.
 #
-# Run it yourself, logged in to OpenBao (BAO_ADDR/BAO_TOKEN set). The bot token
-# goes from OpenBao straight into the adapter's environment and is never
-# printed. The adapter's store is in memory, so idempotency on post_id holds
-# only within one run: do not re-run for a post that already went out.
+# The bot token goes from OpenBao straight into the adapter's environment and
+# is never printed. The adapter's store is in memory, so idempotency on post_id
+# holds only within one run: do not re-run for a post that already went out.
 #
-#   scripts/send-post.sh ~/pr-hall-of-helix/posts/2026-10-08-test-outlet-parametrization.yaml test
+# Run it yourself inside the attended OpenBao login. warden fails closed on any
+# output, so redirect both streams, and use absolute paths (HOME is replaced):
+#
+#   warden access openbao-platform-admin-login --exec -- bash -c \
+#     '/home/worsch/fluid-telegram/scripts/send-post.sh \
+#        /home/worsch/pr-hall-of-helix/posts/<post>.yaml test \
+#        > /home/worsch/send-post.log 2>&1'
 set -euo pipefail
 
 post=$(realpath "$1")
 channel=${2:-test}
-spec=${SPEC:-$HOME/pr-hall-of-helix/presence/telegram.yaml}
 port=${PORT:-18089}
-cd "$(dirname "$0")/.."
+cd "$(dirname "$(realpath "$0")")/.."
+spec=${SPEC:-$(realpath ../pr-hall-of-helix/presence/telegram.yaml)}
+
+# Under `warden access ... --exec`, HOME is a throwaway session directory that
+# holds the OpenBao token helper. Keep Go's caches at the real home so the
+# build does not start from nothing there.
+realhome=$(getent passwd "$(id -u)" | cut -d: -f6)
+export GOPATH=${GOPATH:-$realhome/go}
+export GOMODCACHE=${GOMODCACHE:-$GOPATH/pkg/mod}
+export GOCACHE=${GOCACHE:-$realhome/.cache/go-build}
 
 read -r want reviewed < <(python3 -c '
 import sys, yaml