diff --git a/.woodpecker/deploy-netbird-proxy.yml b/.woodpecker/deploy-netbird-proxy.yml
index a01128d6..ed641379 100644
--- a/.woodpecker/deploy-netbird-proxy.yml
+++ b/.woodpecker/deploy-netbird-proxy.yml
@@ -1,5 +1,7 @@
 when:
+  # Deploy only on master (merge) + manual — never auto-deploy from a branch.
   - event: push
+    branch: master
     path:
       - "ansible/roles/netbird-proxy/**"
       - "ansible/plays/install-netbird-proxy.yml"
diff --git a/ansible/plays/install-netbird-proxy.yml b/ansible/plays/install-netbird-proxy.yml
index 36ce3dd6..17304dc3 100644
--- a/ansible/plays/install-netbird-proxy.yml
+++ b/ansible/plays/install-netbird-proxy.yml
@@ -7,10 +7,8 @@
 #   listed under [netbird_proxy] in inventory/pve_hosts.yml. Docker is
 #   installed by the (Arch-aware) docker-install role.
 # - DNS A/AAAA for the host's own name (e.g. proxy-1.renner.uno) -> its IP.
-# - Vault secret vault_netbird_proxy1_token = a UNIQUE proxy token generated
-#   on the management server:
-#     docker exec -it netbird-management netbird-server token create \
-#       --name proxy-1 --config /var/lib/netbird/config.yaml
+# - Uses the existing vault_netbird_proxy_token (shared with VPS-1) — no new
+#   token to generate; a shared token + same NB_PROXY_DOMAIN forms the cluster.
 # - AFTER deploy + verify: add this host's IP to the proxy domain so traffic
 #   round-robins across the cluster. Repoint proxy.renner.uno away from its
 #   CNAME to netbird.renner.uno (management host) to A/AAAA records listing
diff --git a/ansible/roles/netbird-proxy/defaults/main.yml b/ansible/roles/netbird-proxy/defaults/main.yml
index b6320bbb..6a431bfd 100644
--- a/ansible/roles/netbird-proxy/defaults/main.yml
+++ b/ansible/roles/netbird-proxy/defaults/main.yml
@@ -1,7 +1,7 @@
 ---
 # NetBird reverse-proxy HA cluster member (proxy-only host, e.g. proxy-1).
-# Joins the same proxy cluster as the VPS-1 proxy: identical NB_PROXY_DOMAIN,
-# its OWN token. NetBird load-balances/fails the cluster over via DNS
+# Joins the same proxy cluster as the VPS-1 proxy: identical NB_PROXY_DOMAIN
+# + the same token. NetBird load-balances/fails the cluster over via DNS
 # round-robin on the proxy domain (see plays/install-netbird-proxy.yml).
 
 # MUST match the netbird-server role's netbird_version — the reverse-proxy
@@ -14,8 +14,6 @@ netbird_server_host: netbird.renner.uno
 # Proxy domain — MUST be identical across every cluster member.
 netbird_proxy_domain: "proxy.renner.uno"
 
-# Per-instance token (unique per member, recommended by NetBird). Generated
-# once on the management server and stored in the ansible vault:
-#   docker exec -it netbird-management netbird-server token create \
-#     --name proxy-1 --config /var/lib/netbird/config.yaml
-netbird_proxy_token: "{{ vault_netbird_proxy1_token }}"
+# Reuse VPS-1's proxy token — a shared NB_PROXY_TOKEN across members with the
+# same NB_PROXY_DOMAIN is a valid HA cluster, so no separate token is needed.
+netbird_proxy_token: "{{ vault_netbird_proxy_token }}"