diff --git a/CHANGELOG.md b/CHANGELOG.md
index 79b18e9..4974a43 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,8 +30,11 @@ runtime protocol, adapter interfaces, and CLI behavior are declared stable.
 
 ### SDK boundary
 
+- Token-only startup no longer requires `OPENLINKER_NODE_ID`; the pinned SDK
+  derives a deterministic token-scoped identity. Explicit mTLS startup keeps
+  the provisioned Node ID requirement.
 - Pinned `openlinker-go` commit
-  `bcb5823c5bd08da78802691a31a05501db74e7d8`; dependencies now use standard Go module resolution instead of a checked-in vendor tree.
+  `28adfdebe8e15a07f3f3a75f2c4b4a2b5c736195`; dependencies now use standard Go module resolution instead of a checked-in vendor tree.
 - The SDK owns discovery, token-only/TLS 1.3 mTLS policy, Session identity, WebSocket/Pull
   switching, assignment confirmation, lease renewal, resume, cancellation,
   drain, durable assignment state, encrypted Event/Result delivery, ACK repair,
diff --git a/README.md b/README.md
index 330eb40..ff08b19 100644
--- a/README.md
+++ b/README.md
@@ -98,7 +98,6 @@ Run a local HTTP backend:
 
 ```bash
 OPENLINKER_URL=https://openlinker.example \
-OPENLINKER_NODE_ID=11111111-1111-4111-8111-111111111111 \
 OPENLINKER_AGENT_ID=22222222-2222-4222-8222-222222222222 \
 OPENLINKER_AGENT_TOKEN=ol_agent_xxx \
 OPENLINKER_AGENT_NODE_DATA_DIR=/var/lib/openlinker-agent-node \
@@ -132,7 +131,7 @@ stops startup instead of falling back to the ordinary API origin.
 | Variable | Purpose |
 | --- | --- |
 | `OPENLINKER_URL` | OpenLinker platform origin used to discover the Runtime connection |
-| `OPENLINKER_NODE_ID` | Stable Runtime Node UUID; required for token-only Runtime |
+| `OPENLINKER_NODE_ID` | Optional existing Runtime Node UUID; token-only discovery derives a stable token-scoped value when omitted |
 | `OPENLINKER_AGENT_ID` | Agent UUID; required for token-only Runtime |
 | `OPENLINKER_AGENT_TOKEN` | Long-lived Agent Token kept inside the node |
 | `OPENLINKER_AGENT_NODE_DATA_DIR` | Directory selected for the SDK `FileRuntimeStore` |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index d57f4f0..250e577 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -85,7 +85,6 @@ go build ./cmd/openlinker-agent-node
 
 ```bash
 OPENLINKER_URL=https://openlinker.example \
-OPENLINKER_NODE_ID=11111111-1111-4111-8111-111111111111 \
 OPENLINKER_AGENT_ID=22222222-2222-4222-8222-222222222222 \
 OPENLINKER_AGENT_TOKEN=ol_agent_xxx \
 OPENLINKER_AGENT_NODE_DATA_DIR=/var/lib/openlinker-agent-node \
@@ -115,7 +114,7 @@ SDK 加密 spool 的上限是 512 MiB 和 10,000 条记录。使用量达到 80%
 | 环境变量 | 用途 |
 | --- | --- |
 | `OPENLINKER_URL` | OpenLinker 平台地址，用于自动发现 Runtime 连接信息 |
-| `OPENLINKER_NODE_ID` | 稳定的 Runtime Node UUID；token-only Runtime 必填 |
+| `OPENLINKER_NODE_ID` | 可选的已有 Runtime Node UUID；token-only 发现模式省略时会派生稳定、仅限该凭证的值 |
 | `OPENLINKER_AGENT_ID` | Agent UUID；token-only Runtime 必填 |
 | `OPENLINKER_AGENT_TOKEN` | 只保留在节点内的长效 Agent Token |
 | `OPENLINKER_AGENT_NODE_DATA_DIR` | 交给 SDK `FileRuntimeStore` 的目录 |
diff --git a/go.mod b/go.mod
index 1e9d1c4..045281a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/OpenLinker-ai/openlinker-agent-node
 
 go 1.25.0
 
-require github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260721114051-7ebd3239780d
+require github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260723124010-28adfdebe8e1
 
 require (
 	github.com/gorilla/websocket v1.5.3 // indirect
diff --git a/go.sum b/go.sum
index 34a6279..7cfe44c 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260721114051-7ebd3239780d h1:ecve+UkBh+mvtGxraNM1/vZ/sNXP14GJlfH9Q8gorq0=
-github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260721114051-7ebd3239780d/go.mod h1:bgtqOKPzha8l1oUpFEJQTj563rwUf/rcNmsJEyhbl6g=
+github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260723124010-28adfdebe8e1 h1:7WfM7zU2n6r9tPCgauiUSwcTMnZTl3JCJejAhNEKJ5Q=
+github.com/OpenLinker-ai/openlinker-go v0.2.0-rc1.0.20260723124010-28adfdebe8e1/go.mod h1:bgtqOKPzha8l1oUpFEJQTj563rwUf/rcNmsJEyhbl6g=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
diff --git a/internal/agentnode/config_util_test.go b/internal/agentnode/config_util_test.go
index 4dd6d9b..87445b9 100644
--- a/internal/agentnode/config_util_test.go
+++ b/internal/agentnode/config_util_test.go
@@ -96,7 +96,6 @@ func TestNewFromEnvMapCommand(t *testing.T) {
 func TestNewFromEnvMapDefaultsToDiscoveredTokenOnlySecurity(t *testing.T) {
 	node, err := NewFromEnvMap(Env{
 		"OPENLINKER_URL":                "https://api.example.test",
-		"OPENLINKER_NODE_ID":            "11111111-1111-4111-8111-111111111111",
 		"OPENLINKER_AGENT_ID":           "22222222-2222-4222-8222-222222222222",
 		"OPENLINKER_AGENT_TOKEN":        "ol_agent_token_only",
 		"OPENLINKER_AGENT_NODE_ADAPTER": "command",
@@ -108,6 +107,9 @@ func TestNewFromEnvMapDefaultsToDiscoveredTokenOnlySecurity(t *testing.T) {
 	if node.RuntimeURL != "" {
 		t.Fatalf("Runtime URL override = %q; normal startup must use platform discovery", node.RuntimeURL)
 	}
+	if node.NodeID != "" {
+		t.Fatalf("token-only config forced a Node ID = %q; the SDK must derive it", node.NodeID)
+	}
 	if node.MTLSCertFile != "" || node.MTLSKeyFile != "" || node.MTLSCAFile != "" || node.MTLSServerName != "" {
 		t.Fatalf("default mTLS configuration = cert %q key %q CA %q server %q", node.MTLSCertFile, node.MTLSKeyFile, node.MTLSCAFile, node.MTLSServerName)
 	}