diff --git a/vm/ai-env/ai.env b/vm/ai-env/ai.env
index 00507cd..9e86d81 100644
--- a/vm/ai-env/ai.env
+++ b/vm/ai-env/ai.env
@@ -15,10 +15,10 @@ EMBED_MODEL=text-embedding-3-small
 # Claude API auth: Workload Identity Federation (platform.claude.com/docs/en/manage-claude/wif-providers/gcp). The four ids are
 # not secrets; the agent exchanges this VM's Google identity token (service account selfheal-ai-vm, unique id 117534696004805578884)
 # for a short-lived access token. Empty = federation off (then the key file selfheal-anthropic-api-key is used, if registered).
-ANTHROPIC_FEDERATION_RULE_ID=
-ANTHROPIC_ORGANIZATION_ID=
-ANTHROPIC_SERVICE_ACCOUNT_ID=
-ANTHROPIC_WORKSPACE_ID=
+ANTHROPIC_FEDERATION_RULE_ID=fdrl_01NYa2DRXZMrWhqDC5uNP3Yy
+ANTHROPIC_ORGANIZATION_ID=fc82f31f-51c4-4416-95f5-62584092e1bc
+ANTHROPIC_SERVICE_ACCOUNT_ID=svac_01RMQAkUx4vD6X5scTxwmebU
+ANTHROPIC_WORKSPACE_ID=wrkspc_0149qfHWmbEEBmEh4aL2vHjw
 HARNESS_URL=http://10.20.0.11:8080
 MIMIR_URL=http://10.20.0.10:9009/prometheus
 LOKI_URL=http://10.20.0.10:3100
diff --git a/vm/ai-env/image.tag b/vm/ai-env/image.tag
index e894199..a8a16f1 100644
--- a/vm/ai-env/image.tag
+++ b/vm/ai-env/image.tag
@@ -1 +1 @@
-53ff243
+684e70b