diff --git a/app.py b/app.py
index b012cd4..d6bed00 100644
--- a/app.py
+++ b/app.py
@@ -920,6 +920,7 @@ def _validate_proxy_route(domain: str, upstream: str) -> tuple[str, str, str, st
 class ProxyRouteRequest(BaseModel):
     domain: str
     upstream: str
+    dns_token: str | None = None
 
 
 def _remote_python(script: str, timeout: int = 30) -> tuple[int, str, str]:
@@ -995,8 +996,8 @@ def _get_hetzner_dns_token() -> str:
     return token
 
 
-async def _upsert_dns_records(zone: str, name: str) -> dict:
-    token = await asyncio.to_thread(_get_hetzner_dns_token)
+async def _upsert_dns_records(zone: str, name: str, token_override: str | None = None) -> dict:
+    token = token_override or await asyncio.to_thread(_get_hetzner_dns_token)
     headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
     api = "https://api.hetzner.cloud/v1"
     async with httpx.AsyncClient(timeout=30) as client:
@@ -1027,7 +1028,7 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
         raise HTTPException(400, str(exc)) from exc
     caddy = await asyncio.to_thread(_configure_caddy_route, domain, upstream)
     try:
-        dns = await _upsert_dns_records(zone, name)
+        dns = await _upsert_dns_records(zone, name, req.dns_token)
     except Exception:
         await asyncio.to_thread(_restore_caddy_backup, caddy["backup"])
         raise