diff --git a/app.py b/app.py
index b2cfa6b..32078e7 100644
--- a/app.py
+++ b/app.py
@@ -977,10 +977,26 @@ print(backup)
     return {"status": "reloaded", "backup": backup}
 
 
-async def _upsert_dns_records(zone: str, name: str) -> dict:
+def _get_hetzner_dns_token() -> str:
+    token = _read("HETZNER_DNS_TOKEN")
+    if token:
+        return token
+    rc, _out, err = _ssh(
+        "sascha@10.4.1.116",
+        "sudo /app-config/homelab-butler/vault-sync.sh",
+        timeout=120,
+    )
+    if rc != 0:
+        raise RuntimeError(f"Vault cache sync failed: {err[-300:]}")
+    _load_vault_cache()
     token = _read("HETZNER_DNS_TOKEN")
     if not token:
-        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable")
+        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable after vault sync")
+    return token
+
+
+async def _upsert_dns_records(zone: str, name: str) -> dict:
+    token = await asyncio.to_thread(_get_hetzner_dns_token)
     headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
     api = "https://api.hetzner.cloud/v1"
     async with httpx.AsyncClient(timeout=30) as client: