diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1171668..b058071 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Fixed
+
+- `cbtc-dars/upload_dars.sh` now reads `jwt_token` from the environment. The
+  script set `jwt_token=""`, which replaced an exported token. The upload then
+  went to the Admin API with no `Authorization` header, so it could not
+  succeed on a participant that requires a token. The README tells users to
+  export the token, so that instruction now works.
+
 ## [0.9.0] - 2026-10-08
 
 ### Changed — breaking
diff --git a/cbtc-dars/README.md b/cbtc-dars/README.md
index 5348892..1530db0 100644
--- a/cbtc-dars/README.md
+++ b/cbtc-dars/README.md
@@ -25,13 +25,11 @@ For both methods you will need to have port-forwarding to your participant's adm
 1. **Set your JWT token** (if authentication is required):
 
    ```bash
-   # Option 1: Export as environment variable
    export jwt_token="your-jwt-token-here"
-
-   # Option 2: Edit the script directly
-   # Open upload_dars.sh and set: jwt_token="your-jwt-token-here"
    ```
 
+   Do not write the token into `upload_dars.sh`. The script is a tracked file, so the token could end up in a commit.
+
 2. **Configure Canton admin API URL** (optional):
    - Default is `localhost:5002`
    - If your participant uses a different host/port, edit `canton_admin_api_url` in the script
diff --git a/cbtc-dars/upload_dars.sh b/cbtc-dars/upload_dars.sh
index f384f77..7be622c 100755
--- a/cbtc-dars/upload_dars.sh
+++ b/cbtc-dars/upload_dars.sh
@@ -6,11 +6,11 @@
 #   2. Then uploads all CBTC DARs from dars/cbtc/
 #
 # Configuration:
-#   - jwt_token: Authentication token for Canton API
+#   - jwt_token: Authentication token for Canton API, read from the environment
 #   - canton_admin_api_url: Canton participant node admin API URL
 
 DAR_DIRECTORY="dars"
-jwt_token=""
+jwt_token="${jwt_token:-}"
 
 canton_admin_api_url="localhost:5002"
 canton_admin_api_grpc_base_service="com.digitalasset.canton.admin.participant.v30"