diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl
index 8ff27f5..e1d7ff1 100644
--- a/.chezmoi.toml.tmpl
+++ b/.chezmoi.toml.tmpl
@@ -1,8 +1,10 @@
 {{- $development := promptBoolOnce . "development" "is this a development environment [false]" -}}
 {{- $hellotech := promptBoolOnce . "hellotech" "include work tools [false]" -}}
 {{- $include_legacy := promptBoolOnce . "include_legacy" "include old scripts [false]" -}}
+{{- $bws_token := promptStringOnce . "bws_token" "BitWarden Secrets Manager Access Token" -}}
 
 [data]
+bws_token = {{ $bws_token | quote }}
 development = {{ $development }}
 hellotech = {{ $hellotech }}
 include_legacy = {{ $include_legacy }}
diff --git a/dot_config/profile/profile.d/trubka.sh.tmpl b/dot_config/profile/profile.d/trubka.sh.tmpl
index 6f5e34e..59d0753 100644
--- a/dot_config/profile/profile.d/trubka.sh.tmpl
+++ b/dot_config/profile/profile.d/trubka.sh.tmpl
@@ -1,31 +1,31 @@
 # chezmoi:template:left-delimiter=#{{
 #{{- /* vim: set filetype=sh: */ -}}
-#{{- if .hellotech -}}
+#{{- if and .hellotech .bws_token -}}
 
 config_trubka_buddy () {
-    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "9598a627-0d32-4398-98fb-b18c014b9d7d").value }}
+    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "9598a627-0d32-4398-98fb-b18c014b9d7d" .bws_token).value }}
     export TRUBKA_TLS=true
     export TRUBKA_PROTO_ROOT=#{{ .chezmoi.homeDir }}/hellotech/entities
-    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "6fc85366-d6bc-438f-a75b-b18c014c7d77").value }}
-    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "d8153476-d170-4d86-9804-b18c014c9a7b").value }}
+    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "6fc85366-d6bc-438f-a75b-b18c014c7d77" .bws_token).value }}
+    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "d8153476-d170-4d86-9804-b18c014c9a7b" .bws_token).value }}
     export TRUBKA_SASL_MECHANISM=plain
 }
 
 config_trubka_dev () {
-    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "59d193cb-1b62-42cf-a753-b18c014cd5f6").value }}
+    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "59d193cb-1b62-42cf-a753-b18c014cd5f6" .bws_token).value }}
     export TRUBKA_TLS=true
     export TRUBKA_PROTO_ROOT=#{{ .chezmoi.homeDir }}/hellotech/entities
-    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "123253f2-f720-4a56-af15-b18c014cf26b").value }}
-    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "4cb2b59b-11ca-4cc2-a9e5-b18c014d11fd").value }}
+    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "123253f2-f720-4a56-af15-b18c014cf26b" .bws_token).value }}
+    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "4cb2b59b-11ca-4cc2-a9e5-b18c014d11fd" .bws_token).value }}
     export TRUBKA_SASL_MECHANISM=plain
 }
 
 config_trubka_prod () {
-    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "1e295c46-34b6-4ee9-b801-b18c014d3102").value }}
+    export TRUBKA_BROKERS=#{{ (bitwardenSecrets "1e295c46-34b6-4ee9-b801-b18c014d3102" .bws_token).value }}
     export TRUBKA_TLS=true
     export TRUBKA_PROTO_ROOT=#{{ .chezmoi.homeDir }}/hellotech/entities
-    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "9d5de1a1-796d-4208-a5a7-b18c014d4e8e").value }}
-    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "a7c38ba6-95be-42c0-8ed8-b18c014d6acf").value }}
+    export TRUBKA_SASL_USERNAME=#{{ (bitwardenSecrets "9d5de1a1-796d-4208-a5a7-b18c014d4e8e" .bws_token).value }}
+    export TRUBKA_SASL_PASSWORD=#{{ (bitwardenSecrets "a7c38ba6-95be-42c0-8ed8-b18c014d6acf" .bws_token).value }}
     export TRUBKA_SASL_MECHANISM=plain
 }