diff --git a/app.py b/app.py
index 32078e7..b2cfa6b 100644
--- a/app.py
+++ b/app.py
@@ -977,26 +977,10 @@ print(backup)
     return {"status": "reloaded", "backup": backup}
 
 
-def _get_hetzner_dns_token() -> str:
-    token = _read("HETZNER_DNS_TOKEN")
-    if token:
-        return token
-    rc, _out, err = _ssh(
-        "sascha@10.4.1.116",
-        "sudo /app-config/homelab-butler/vault-sync.sh",
-        timeout=120,
-    )
-    if rc != 0:
-        raise RuntimeError(f"Vault cache sync failed: {err[-300:]}")
-    _load_vault_cache()
+async def _upsert_dns_records(zone: str, name: str) -> dict:
     token = _read("HETZNER_DNS_TOKEN")
     if not token:
-        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable after vault sync")
-    return token
-
-
-async def _upsert_dns_records(zone: str, name: str) -> dict:
-    token = await asyncio.to_thread(_get_hetzner_dns_token)
+        raise RuntimeError("HETZNER_DNS_TOKEN is unavailable")
     headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
     api = "https://api.hetzner.cloud/v1"
     async with httpx.AsyncClient(timeout=30) as client:
diff --git a/tests/test_app.py b/tests/test_app.py
index e6922c4..681fae3 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -309,16 +309,3 @@ def test_proxy_route_endpoint_configures_caddy_and_dns(monkeypatch):
         ("caddy", "speed.guck.tv", "127.0.0.1:8080"),
         ("dns", "guck.tv", "speed"),
     ]
-
-
-def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
-    reads = iter([None, "refreshed-token"])
-    calls = []
-    monkeypatch.setattr(app, "_read", lambda _name: next(reads))
-    monkeypatch.setattr(app, "_load_vault_cache", lambda: calls.append("reload"))
-    monkeypatch.setattr(app, "_ssh", lambda host, command, timeout=600: (calls.append((host, command, timeout)) or (0, "vault-sync: ok", "")))
-
-    assert app._get_hetzner_dns_token() == "refreshed-token"
-    assert calls[0][0] == "sascha@10.4.1.116"
-    assert calls[0][1] == "sudo /app-config/homelab-butler/vault-sync.sh"
-    assert calls[1] == "reload"