diff --git a/app.py b/app.py
index ee5ffdf..c5ffbf8 100644
--- a/app.py
+++ b/app.py
@@ -984,9 +984,6 @@ def _get_hetzner_dns_token() -> str:
     token = _read("HETZNER_DNS_TOKEN")
     if token:
         return token
-    aliases = [value for key, value in _vault_cache.items() if "hetzner" in key.lower() and "dns" in key.lower() and value.strip()]
-    if len(aliases) == 1:
-        return aliases[0].strip()
     rc, _out, err = _ssh(
         "sascha@10.4.1.116",
         "sudo bash /data/stacks/homelab-butler/vault-sync.sh",
diff --git a/tests/test_app.py b/tests/test_app.py
index cf541dd..a3ea996 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -277,13 +277,6 @@ def test_dns_rrset_dry_run_returns_only_selected_records(monkeypatch):
     assert body["deleted"] == []
 
 
-def test_hetzner_dns_token_accepts_single_sanitized_vault_alias(monkeypatch):
-    monkeypatch.setattr(app, "_vault_cache", {"hetzner-dns-api": "secret-value", "other": "ignored"})
-    monkeypatch.setattr(app, "_read", lambda _name: None)
-    monkeypatch.setattr(app, "_ssh", lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("must not sync vault")))
-    assert app._get_hetzner_dns_token() == "secret-value"
-
-
 def test_invalid_log_target_is_rejected_before_ssh():
     with TestClient(app.app) as client:
         response = client.get(