diff --git a/README.md b/README.md
index 63a7e21..60e8c0c 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ A machine that should only *run nodes* for an engine elsewhere installs less:
 
 ```sh
 pip install fluksio-worker
-fluksio-worker --url wss://api.fluksio.com/api/v1/workers/attach --token "$TOKEN" --labels gpu
+FLUKSIO_WORKER_TOKEN=… fluksio-worker --url wss://api.fluksio.com/api/v1/workers/attach --labels gpu
 ```
 
 ## Getting started
diff --git a/docs/code/cli.md b/docs/code/cli.md
index d8219d1..d78abaa 100644
--- a/docs/code/cli.md
+++ b/docs/code/cli.md
@@ -231,8 +231,7 @@ agent's own parser: it is the same program `fluksio-worker` installs, so the
 two are interchangeable:
 
 ```sh
-fluksio worker --url wss://api.${DOMAIN}/api/v1/workers/attach \
-               --token "$FLUKSIO_WORKER_TOKEN" --labels gpu
+fluksio worker --url wss://api.${DOMAIN}/api/v1/workers/attach --labels gpu
 ```
 
 See [Remote workers](workers.md).
diff --git a/docs/code/workers.md b/docs/code/workers.md
index 3dc235b..89049c4 100644
--- a/docs/code/workers.md
+++ b/docs/code/workers.md
@@ -16,7 +16,6 @@ pip install fluksio-worker
 
 fluksio-worker \
   --url wss://api.${DOMAIN}/api/v1/workers/attach \
-  --token "$FLUKSIO_WORKER_TOKEN" \
   --labels gpu,cuda12 \
   --python /opt/torch-venv/bin/python
 ```
@@ -29,7 +28,7 @@ driver in order to run a training step. An engine host already has it, and
 | Option | Default | What it does |
 |---|---|---|
 | `--url` | **required** | `wss://…/api/v1/workers/attach` |
-| `--token` | `$FLUKSIO_WORKER_TOKEN` | the credential, minted on the engine |
+| `--token` | `$FLUKSIO_WORKER_TOKEN` | the credential, minted on the engine; on the command line any user of the machine reads it from `ps`, so prefer the variable |
 | `--name` | this host's name | sent along; the worker list shows the token's name |
 | `--labels` | the token's | comma-separated; must match the labels the token was minted with |
 | `--python` | this interpreter | the interpreter node code runs on |
diff --git a/docs/concepts/runs.md b/docs/concepts/runs.md
index f3374c1..e255728 100644
--- a/docs/concepts/runs.md
+++ b/docs/concepts/runs.md
@@ -270,7 +270,6 @@ pip install fluksio-worker
 
 fluksio-worker \
   --url wss://api.${DOMAIN}/api/v1/workers/attach \
-  --token "$FLUKSIO_WORKER_TOKEN" \
   --labels gpu,cuda12 \
   --python /opt/torch-venv/bin/python
 ```
diff --git a/docs/getting-started/data-science.md b/docs/getting-started/data-science.md
index 044f447..9aa0eb7 100644
--- a/docs/getting-started/data-science.md
+++ b/docs/getting-started/data-science.md
@@ -161,11 +161,10 @@ nothing of yours, so a container is always this case.
 
     `pip install fluksio-worker` into the environment the training code runs
     in, and node code runs on it: `--python` defaults to the interpreter the
-    agent was started with.
+    agent was started with. It reads its token from `FLUKSIO_WORKER_TOKEN`.
 
     ```sh
-    fluksio worker --url ws://127.0.0.1:8000/api/v1/workers/attach \
-      --token "$WORKER_TOKEN" --labels gpu
+    fluksio worker --url ws://127.0.0.1:8000/api/v1/workers/attach --labels gpu
     ```
 
     Then give the node `device="gpu"`; see [Remote workers](../code/workers.md).
@@ -469,7 +468,7 @@ alongside the store's own. `--dry-run` prints all of this and uploads nothing;
 
     ```sh
     fluksio worker --url ws://127.0.0.1:8000/api/v1/workers/attach \
-      --token "$WORKER_TOKEN" --labels local --python "$(which python)"
+      --labels local --python "$(which python)"
     ```
 
     Then give the node `device="local"`.
diff --git a/docs/getting-started/facility-automation.md b/docs/getting-started/facility-automation.md
index 9d83c04..697b62f 100644
--- a/docs/getting-started/facility-automation.md
+++ b/docs/getting-started/facility-automation.md
@@ -258,13 +258,12 @@ curl -X POST https://api.${DOMAIN}/api/v1/workers/tokens \
 The labels are signed into it, so the worker can repeat them with `--labels`
 but not change them.
 
-On the other machine:
+On the other machine, with that token in `FLUKSIO_WORKER_TOKEN`:
 
 ```sh
 pip install fluksio-worker
 fluksio-worker \
   --url wss://api.${DOMAIN}/api/v1/workers/attach \
-  --token "$WORKER_TOKEN" \
   --labels shed,gpio \
   --parallel 2
 ```
diff --git a/worker/README.md b/worker/README.md
index aac4dec..3f240d5 100644
--- a/worker/README.md
+++ b/worker/README.md
@@ -9,7 +9,6 @@ pip install fluksio-worker
 
 fluksio-worker \
   --url wss://api.example.com/api/v1/workers/attach \
-  --token "$FLUKSIO_WORKER_TOKEN" \
   --labels gpu,cuda12 \
   --python /opt/torch-venv/bin/python
 ```
diff --git a/worker/fluksio_worker/agent.py b/worker/fluksio_worker/agent.py
index 4f80ffd..8c91ca5 100644
--- a/worker/fluksio_worker/agent.py
+++ b/worker/fluksio_worker/agent.py
@@ -3,8 +3,7 @@
 Point it at the engine on the box with the GPU and it dials in::
 
     pip install fluksio-worker
-    fluksio-worker --url wss://api.example.com/api/v1/workers/attach \\
-        --token "$FLUKSIO_WORKER_TOKEN" --labels gpu
+    fluksio-worker --url wss://api.example.com/api/v1/workers/attach --labels gpu
 
 Install it into the environment the training code already runs in and node
 code runs on that: ``--python`` defaults to the interpreter this was started