diff --git a/app.py b/app.py
index db5ebbe..ee5ffdf 100644
--- a/app.py
+++ b/app.py
@@ -980,32 +980,13 @@ print(backup)
     return {"status": "reloaded", "backup": backup}
 
 
-def _normalize_hetzner_dns_token(raw: str) -> str | None:
-    raw = (raw or "").strip()
-    if not raw:
-        return None
-    if raw.isascii() and not any(ch.isspace() for ch in raw) and re.fullmatch(r"[A-Za-z0-9._-]{24,}", raw):
-        return raw
-    candidates = []
-    labelled = re.findall(r"(?is)(?:token|api[ -]?key)[^\n:=]{0,80}(?::|=|\n)\s*([A-Za-z0-9._-]{24,})", raw)
-    candidates.extend(value for value in labelled if value.isascii())
-    for line in raw.splitlines():
-        if "token" not in line.lower() and "api key" not in line.lower() and "api-key" not in line.lower():
-            continue
-        value = re.split(r"[:=]", line, maxsplit=1)[-1].strip().strip("`'\"")
-        if value.isascii() and re.fullmatch(r"[A-Za-z0-9._-]{24,}", value):
-            candidates.append(value)
-    return candidates[0] if len(set(candidates)) == 1 else None
-
-
 def _get_hetzner_dns_token() -> str:
-    token = _normalize_hetzner_dns_token(_read("HETZNER_DNS_TOKEN") or "")
+    token = _read("HETZNER_DNS_TOKEN")
     if token:
         return token
-    aliases = [_normalize_hetzner_dns_token(value) for key, value in _vault_cache.items() if "hetzner" in key.lower() and "dns" in key.lower()]
-    aliases = [value for value in aliases if value]
-    if len(set(aliases)) == 1:
-        return aliases[0]
+    aliases = [value for key, value in _vault_cache.items() if "hetzner" in key.lower() and "dns" in key.lower() and value.strip()]
+    if len(aliases) == 1:
+        return aliases[0].strip()
     rc, _out, err = _ssh(
         "sascha@10.4.1.116",
         "sudo bash /data/stacks/homelab-butler/vault-sync.sh",