diff --git a/scripts/openbao-apply-ssh-engine.sh b/scripts/openbao-apply-ssh-engine.sh
index 1b78cc4..db9f2bc 100755
--- a/scripts/openbao-apply-ssh-engine.sh
+++ b/scripts/openbao-apply-ssh-engine.sh
@@ -189,7 +189,8 @@ spec = yaml.safe_load(open(spec_path))
 roles = spec.get("roles") or {}
 for role_name, params in roles.items():
     args = [f"{k}={v}" for k, v in params.items()]
-    cmd = ["bao", "write", f"{mount}/roles/{role_name}"] + args
+    # The exec wrapper below already runs `bao`; pass only its arguments.
+    cmd = ["write", f"{mount}/roles/{role_name}"] + args
     proc = subprocess.run(
         kubectl_parts + ["exec", "-i", "-n", namespace, pod, "--", "sh", "-c",
          "read -r BAO_TOKEN; export BAO_TOKEN; exec bao \"$@\"", "sh"] + cmd,