diff --git a/scripts/daily-infra-report.py b/scripts/daily-infra-report.py
index a2b52be..6db69df 100755
--- a/scripts/daily-infra-report.py
+++ b/scripts/daily-infra-report.py
@@ -22,8 +22,10 @@ AUTH = "Authorization: PVEAPIToken=monitoring@pve!mumuni=eafd56c5-93d4-4d40-a41d
 
 ZULIP_SITE = "https://chat.sysloggh.net"
 ZULIP_EMAIL = "abiba-bot@chat.sysloggh.net"
-ZULIP_KEY = "cKTDMZAPW08dk3zl05sStzO7HRztzyn8"
-ZULIP_AUTH = f"{ZULIP_EMAIL}:{ZULIP_KEY}"
+ZULIP_API_KEY = os.environ.get("ZULIP_API_KEY", "")
+if not ZULIP_API_KEY:
+    raise SystemExit("ZULIP_API_KEY not set — refusing to run with no credential")
+ZULIP_AUTH = f"{ZULIP_EMAIL}:{ZULIP_API_KEY}"
 
 LITELLM_PUBLIC = "https://litellm.sysloggh.net"
 LITELLM_BACKEND = "192.168.68.116"
diff --git a/scripts/zulip-monitor.sh b/scripts/zulip-monitor.sh
index 45838db..f2224ca 100755
--- a/scripts/zulip-monitor.sh
+++ b/scripts/zulip-monitor.sh
@@ -7,9 +7,11 @@
 # agent leg is retired — see the note after the Tanko leg.
 set -euo pipefail
 
+# Credentials sourced from environment variable ZULIP_API_KEY (set by vault-backed start script)
+# Never fall back to a literal key
+ZULIP_API_KEY="${ZULIP_API_KEY:?ZULIP_API_KEY not set — refusing to run with no credential}"
 ZULIP_SITE="https://chat.sysloggh.net"
 ZULIP_EMAIL="abiba-bot@chat.sysloggh.net"
-ZULIP_KEY="cKTDMZAPW08dk3zl05sStzO7HRztzyn8"
 OWNER_ZULIP_ID="9"
 
 
@@ -27,12 +29,12 @@ notify() {
   local form
   form="type=private&to=%5B${OWNER_ZULIP_ID}%5D&content=$(python3 -c "import urllib.parse; print(urllib.parse.quote('''${content}'''))")"
   curl -sf -X POST "${ZULIP_SITE}/api/v1/messages" \
-    -u "${ZULIP_EMAIL}:${ZULIP_KEY}" \
+    -u "${ZULIP_EMAIL}:${ZULIP_API_KEY}" \
     -d "${form}" > /dev/null 2>&1 || true
   # Zulip stream post to #agent-hub on topic 'zulip-health'
   local stream_content="${severity} Zulip Monitor: ${msg}"
   curl -sf -X POST "${ZULIP_SITE}/api/v1/messages" \
-    -u "${ZULIP_EMAIL}:${ZULIP_KEY}" \
+    -u "${ZULIP_EMAIL}:${ZULIP_API_KEY}" \
     -d "type=stream&to=%5B7%5D&topic=zulip-health&content=$(printf '%s' "${stream_content}" | python3 -c "import sys,urllib.parse; print(urllib.parse.quote_from_bytes(sys.stdin.buffer.read()))")" \
     > /dev/null 2>&1 \
     || echo "  WARN: stream alert to #agent-hub (zulip-health) delivery failed (curl exit $?)" >> "$LOG"