diff --git a/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml b/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
index 37d34419..99c792af 100644
--- a/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
+++ b/platform/cluster/flux/apps/stateless/agents-api/deployment-enschede-ws.yaml
@@ -192,6 +192,15 @@ spec:
                   name: agents-login-internal
                   key: token
                   optional: true
+            # Bearer the worker presents when posting captured credentials to
+            # /api/v1/internal/credentials. Same shared secret as INTERNAL_TOKEN;
+            # without it the ingest filter has no expected token and 401s.
+            - name: CREDENTIAL_INGEST_BEARER
+              valueFrom:
+                secretKeyRef:
+                  name: agents-login-internal
+                  key: token
+                  optional: true
           ports:
             - containerPort: 8082
               name: http
diff --git a/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml b/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
index e83454d0..ee03af95 100644
--- a/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
+++ b/platform/cluster/flux/apps/stateless/agents-api/deployment.yaml
@@ -209,6 +209,15 @@ spec:
                   name: agents-login-internal
                   key: token
                   optional: true
+            # Bearer the worker presents when posting captured credentials to
+            # /api/v1/internal/credentials. Same shared secret as INTERNAL_TOKEN;
+            # without it the ingest filter has no expected token and 401s.
+            - name: CREDENTIAL_INGEST_BEARER
+              valueFrom:
+                secretKeyRef:
+                  name: agents-login-internal
+                  key: token
+                  optional: true
           ports:
             - containerPort: 8082
               name: http