diff --git a/nix/pkgs/flipperzero-firmware/default.nix b/nix/pkgs/flipperzero-firmware/default.nix
index 071f15188d..8817cda867 100644
--- a/nix/pkgs/flipperzero-firmware/default.nix
+++ b/nix/pkgs/flipperzero-firmware/default.nix
@@ -106,8 +106,18 @@ pkgs.stdenvNoCC.mkDerivation rec {
     firmware = depot.nix.pkgs.flipperzero-firmware;
   in pkgs.writeShellApplication {
     name = "upload-f0";
-    runtimeInputs = [ pkgs.google-cloud-sdk ];
+    runtimeInputs = [ pkgs.google-cloud-sdk pkgs.vault ];
     text = ''
+      vault_path=unix:///run/tokend/sock
+
+      if [[ "$(groups)" =~ (.* |^)"users"($| .*) ]] || ! test -f /etc/NIXOS; then
+        vault_path=https://vault.int.lukegb.com
+      fi
+
+      echo "Fetching token from Vault at $vault_path..."
+      token="$(vault read --field=token --address="$vault_path" gcp/roleset/lukegbcom-deployer/token)"
+      export CLOUDSDK_AUTH_ACCESS_TOKEN="$token"
+
       echo "Uploading ${firmware.version}"
       gcloud storage cp "${firmware}/f7-C/*-update-*.tgz" "gs://lukegb-flipperzero/${firmware.name}.tgz"
     '';