diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index e4619b7..10dc862 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: ghp
-          image: ghcr.io/goodtune/ghp:0.20.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/ghp:v0.20.0-unkin4
           imagePullPolicy: IfNotPresent
           # Drop the image's default --migrate so replicas never race migrations;
           # schema is applied by the wave-1 migrate hook Job instead.
@@ -88,6 +88,17 @@ spec:
                 secretKeyRef:
                   name: ghp-app
                   key: encryption_key
+            # Static admin service token for machine callers (the Vault ghp
+            # secrets engine authenticates with it to mint scoped tokens).
+            # optional: ghp runs fine without it until Ben seeds `service_token`
+            # into kv/kubernetes/namespace/ghp/default/app; the ghp-app reloader
+            # annotation then rolls this Deployment to pick it up.
+            - name: GHP_AUTH_SERVICE_TOKENS
+              valueFrom:
+                secretKeyRef:
+                  name: ghp-app
+                  key: service_token
+                  optional: true
           volumeMounts:
             - name: github-app
               mountPath: /etc/ghp/github-app