diff --git a/services/comms/oneoffs/synapse-admin-ensure-job.yaml b/services/comms/oneoffs/synapse-admin-ensure-job.yaml
index 668c74c..ff7b49e 100644
--- a/services/comms/oneoffs/synapse-admin-ensure-job.yaml
+++ b/services/comms/oneoffs/synapse-admin-ensure-job.yaml
@@ -1,12 +1,12 @@
 # services/comms/oneoffs/synapse-admin-ensure-job.yaml
-# One-off job for comms/synapse-admin-ensure-13.
-# Purpose: synapse admin ensure 13 (see container args/env in this file).
+# One-off job for comms/synapse-admin-ensure-14.
+# Purpose: synapse admin ensure 14 (see container args/env in this file).
 # Run by setting spec.suspend to false, reconcile, then set it back to true.
 # Safe to delete the finished Job/pod; it should not run continuously.
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: synapse-admin-ensure-13
+  name: synapse-admin-ensure-14
   namespace: comms
 spec:
   suspend: false
@@ -113,8 +113,10 @@ spec:
 
               def ensure_admin_creds(token: str) -> dict:
                   data = vault_get(token, "comms/synapse-admin")
-                  username = (data.get("username") or "").strip() or "othrys-seeder"
-                  data["username"] = username
+                  username = "othrys-seeder"
+                  if data.get("username") != username:
+                      data["username"] = username
+                      data.pop("access_token", None)
                   vault_put(token, "comms/synapse-admin", data)
                   return data