diff --git a/manifests/forgejo-mailer-externalsecret.yaml b/manifests/forgejo-mailer-externalsecret.yaml
index 0ebbe5d..4585bc1 100644
--- a/manifests/forgejo-mailer-externalsecret.yaml
+++ b/manifests/forgejo-mailer-externalsecret.yaml
@@ -1,7 +1,7 @@
 # Forgejo IONOS SMTP password from OpenBao (RAIL-HO-WP-0005-T06).
 #
 # OpenBao path (platform KV v2): workloads/forgejo/forgejo-mailer
-# Field: MAILER_PASSWD (optional SMTP_USER for non-Helm consumers)
+# Field: PASSWD (OpenBao key); synced to Secret key MAILER_PASSWD for Helm
 #
 # Prereqs on railiance01:
 #   - External Secrets Operator (make eso-deploy)
@@ -27,4 +27,4 @@ spec:
     - secretKey: MAILER_PASSWD
       remoteRef:
         key: workloads/forgejo/forgejo-mailer
-        property: MAILER_PASSWD
\ No newline at end of file
+        property: PASSWD
\ No newline at end of file
diff --git a/tools/forgejo-openbao-eso-token-apply.sh b/tools/forgejo-openbao-eso-token-apply.sh
index d6b2f16..40d8be6 100755
--- a/tools/forgejo-openbao-eso-token-apply.sh
+++ b/tools/forgejo-openbao-eso-token-apply.sh
@@ -22,8 +22,21 @@ fi
 
 echo "OpenBao addr: $BAO_ADDR"
 echo "Policy: $POLICY_NAME"
-read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
-echo >&2
+
+if [[ -n "${BAO_TOKEN:-}" ]]; then
+  :
+elif [[ -n "${OPENBAO_TOKEN_FILE:-}" && -f "${OPENBAO_TOKEN_FILE}" ]]; then
+  BAO_TOKEN="$(head -n 1 "${OPENBAO_TOKEN_FILE}")"
+else
+  read -r -s -p "OpenBao operator token (coulombcore / bao.coulomb.social): " BAO_TOKEN
+  echo >&2
+fi
+
+if [[ -z "${BAO_TOKEN:-}" ]]; then
+  echo "ERROR: empty OpenBao token" >&2
+  exit 1
+fi
+
 export BAO_ADDR BAO_TOKEN
 
 health="$(curl -fsS "$BAO_ADDR/v1/sys/health")"