diff --git a/clusters/unraid-lab/apps/grafana-cloud-secrets/application.yaml b/clusters/unraid-lab/apps/grafana-cloud-secrets/application.yaml
new file mode 100644
index 0000000..6993316
--- /dev/null
+++ b/clusters/unraid-lab/apps/grafana-cloud-secrets/application.yaml
@@ -0,0 +1,22 @@
+# Bitwarden Secrets Manager supplies Grafana Cloud credentials to Alloy without
+# storing credential values in Git.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: grafana-cloud-secrets
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git
+    targetRevision: HEAD
+    path: clusters/unraid-lab/apps/grafana-cloud-secrets/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/bitwardensecret.yaml b/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/bitwardensecret.yaml
new file mode 100644
index 0000000..0e633e2
--- /dev/null
+++ b/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/bitwardensecret.yaml
@@ -0,0 +1,29 @@
+apiVersion: k8s.bitwarden.com/v1
+kind: BitwardenSecret
+metadata:
+  name: grafana-cloud
+  namespace: monitoring
+spec:
+  organizationId: "28d10c96-b6fb-4e33-b486-b1f700017837"
+  projectId: "8e33ca9c-37d5-4437-a977-b4a101001e2f"
+  secretName: grafana-cloud
+  authToken:
+    secretName: bw-auth-token
+    secretKey: token
+  map:
+    - bwSecretId: "586aca5a-53d4-486f-9215-b4a3012b4d6e" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: metrics-username
+    - bwSecretId: "0167adff-e881-4263-a8a6-b4a3012b4dac" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: metrics-password
+    - bwSecretId: "1e7d563b-3318-4702-b5a3-b4a3012b4dea" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: logs-username
+    - bwSecretId: "a690572b-f1c1-4b3b-ae2e-b4a3012b4e2e" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: logs-password
+    - bwSecretId: "7d06095d-73a5-4ead-909b-b4a3012b4e63" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: otlp-username
+    - bwSecretId: "fb9fd11c-d1b5-4359-9928-b4a3012b6c7c" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: otlp-password
+    - bwSecretId: "b39c9e04-299d-43e6-b675-b4a3012b4ecc" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: fleet-username
+    - bwSecretId: "2994fb3e-8eb0-4f30-b287-b4a3012b4f07" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: fleet-password
diff --git a/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/kustomization.yaml b/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/kustomization.yaml
new file mode 100644
index 0000000..31c4ba9
--- /dev/null
+++ b/clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - bitwardensecret.yaml
diff --git a/omni/scripts/inject-bitwarden-auth-token.sh b/omni/scripts/inject-bitwarden-auth-token.sh
new file mode 100755
index 0000000..3043101
--- /dev/null
+++ b/omni/scripts/inject-bitwarden-auth-token.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Bootstrap the Bitwarden operator's machine token through Omni, never Git.
+set -euo pipefail
+
+CLUSTER="unraid-lab"
+BWS_ACCESS_TOKEN="${BWS_ACCESS_TOKEN:-$(security find-generic-password -w -a "$USER" -s BWS_ACCESS_TOKEN)}"
+
+temporary="$(mktemp -d)"
+trap 'rm -rf "$temporary"' EXIT
+
+cat >"$temporary/manifests.yaml" <<YAML
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bw-auth-token
+  namespace: monitoring
+type: Opaque
+stringData:
+  token: "${BWS_ACCESS_TOKEN}"
+YAML
+
+python3 - "$temporary/manifests.yaml" "$temporary/configpatch.yaml" "$CLUSTER" <<'PY'
+import sys
+from pathlib import Path
+
+import yaml
+
+
+class Literal(str):
+    pass
+
+
+def represent_literal(dumper, data):
+    return dumper.represent_scalar("tag:yaml.org,2002:str", data, style="|")
+
+
+yaml.SafeDumper.add_representer(Literal, represent_literal)
+
+manifests_path = Path(sys.argv[1])
+configpatch_path = Path(sys.argv[2])
+cluster = sys.argv[3]
+manifests = manifests_path.read_text()
+list(yaml.safe_load_all(manifests))
+
+patch = {
+    "cluster": {
+        "inlineManifests": [
+            {"name": "bitwarden-auth-token", "contents": Literal(manifests)}
+        ]
+    }
+}
+configpatch = {
+    "metadata": {
+        "namespace": "default",
+        "type": "ConfigPatches.omni.sidero.dev",
+        "id": f"510-cluster-{cluster}-bitwarden-auth-token",
+        "labels": {"omni.sidero.dev/cluster": cluster},
+    },
+    "spec": {"data": Literal(yaml.safe_dump(patch, sort_keys=False))},
+}
+configpatch_path.write_text(yaml.safe_dump(configpatch, sort_keys=False))
+print("manifests: valid")
+PY
+
+if [[ "${1:-}" == "--apply" ]]; then
+  omnictl apply -f "$temporary/configpatch.yaml"
+  printf 'Bitwarden auth-token ConfigPatch applied to Omni.\n'
+else
+  printf 'Bitwarden auth-token ConfigPatch rendered and validated; re-run with --apply to push to Omni.\n'
+fi
diff --git a/omni/scripts/inject-grafana-cloud-secret.sh b/omni/scripts/inject-grafana-cloud-secret.sh
deleted file mode 100755
index 766fc00..0000000
--- a/omni/scripts/inject-grafana-cloud-secret.sh
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-# Store the Grafana Cloud destination credential in Omni, never Git.
-set -euo pipefail
-
-CLUSTER="unraid-lab"
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-ENV_FILE="${SECRETS_ENV:-$REPO_ROOT/omni/secrets.env}"
-YQ="${YQ:-yq}"
-
-[[ -f "$ENV_FILE" ]] || {
-  printf 'missing %s\n' "$ENV_FILE" >&2
-  exit 1
-}
-set -a
-# shellcheck source=/dev/null
-. "$ENV_FILE"
-set +a
-
-for name in \
-  GRAFANA_CLOUD_METRICS_USERNAME GRAFANA_CLOUD_METRICS_TOKEN \
-  GRAFANA_CLOUD_LOGS_USERNAME GRAFANA_CLOUD_LOGS_TOKEN \
-  GRAFANA_CLOUD_OTLP_USERNAME GRAFANA_CLOUD_OTLP_TOKEN \
-  GRAFANA_CLOUD_FLEET_USERNAME GRAFANA_CLOUD_FLEET_TOKEN; do
-  [[ -n "${!name:-}" ]] || {
-    printf 'set %s in %s\n' "$name" "$ENV_FILE" >&2
-    exit 1
-  }
-done
-
-temporary="$(mktemp -d)"
-trap 'rm -rf "$temporary"' EXIT
-
-cat >"$temporary/manifests.yaml" <<YAML
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: grafana-cloud
-  namespace: monitoring
-type: Opaque
-stringData:
-  metrics-username: "${GRAFANA_CLOUD_METRICS_USERNAME}"
-  metrics-password: "${GRAFANA_CLOUD_METRICS_TOKEN}"
-  logs-username: "${GRAFANA_CLOUD_LOGS_USERNAME}"
-  logs-password: "${GRAFANA_CLOUD_LOGS_TOKEN}"
-  otlp-username: "${GRAFANA_CLOUD_OTLP_USERNAME}"
-  otlp-password: "${GRAFANA_CLOUD_OTLP_TOKEN}"
-  fleet-username: "${GRAFANA_CLOUD_FLEET_USERNAME}"
-  fleet-password: "${GRAFANA_CLOUD_FLEET_TOKEN}"
-YAML
-
-printf 'cluster:\n  inlineManifests: []\n' >"$temporary/patch.yaml"
-MF="$temporary/manifests.yaml" "$YQ" -i \
-  '.cluster.inlineManifests += [{"name":"grafana-cloud-secret","contents": loadstr(strenv(MF))}] |
-   (.cluster.inlineManifests[0].contents) style="literal"' "$temporary/patch.yaml"
-
-cat >"$temporary/configpatch.yaml" <<YAML
-metadata:
-  namespace: default
-  type: ConfigPatches.omni.sidero.dev
-  id: 510-cluster-${CLUSTER}-grafana-cloud-secret
-  labels:
-    omni.sidero.dev/cluster: ${CLUSTER}
-spec:
-  data: ""
-YAML
-P="$temporary/patch.yaml" "$YQ" -i \
-  '.spec.data = loadstr(strenv(P)) | .spec.data style="literal"' "$temporary/configpatch.yaml"
-
-python3 -c "import yaml; list(yaml.safe_load_all(open('$temporary/manifests.yaml'))); print('manifests: valid')"
-
-if [[ "${1:-}" == "--apply" ]]; then
-  omnictl apply -f "$temporary/configpatch.yaml"
-  printf 'Grafana Cloud secret ConfigPatch applied to Omni.\n'
-else
-  printf 'Grafana Cloud secret ConfigPatch rendered and validated; re-run with --apply to push to Omni.\n'
-fi