diff --git a/app.py b/app.py
index a9523f1..b012cd4 100644
--- a/app.py
+++ b/app.py
@@ -983,7 +983,7 @@ def _get_hetzner_dns_token() -> str:
         return token
     rc, _out, err = _ssh(
         "sascha@10.4.1.116",
-        "sudo /data/stacks/homelab-butler/vault-sync.sh",
+        "sudo bash /data/stacks/homelab-butler/vault-sync.sh",
         timeout=120,
     )
     if rc != 0:
diff --git a/tests/test_app.py b/tests/test_app.py
index 6ea7a00..7d1e3ee 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -320,5 +320,5 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
 
     assert app._get_hetzner_dns_token() == "refreshed-token"
     assert calls[0][0] == "sascha@10.4.1.116"
-    assert calls[0][1] == "sudo /data/stacks/homelab-butler/vault-sync.sh"
+    assert calls[0][1] == "sudo bash /data/stacks/homelab-butler/vault-sync.sh"
     assert calls[1] == "reload"