diff --git a/deploy/provision-machine-credential.sh b/deploy/provision-machine-credential.sh
index 9abcd99..5acbb31 100644
--- a/deploy/provision-machine-credential.sh
+++ b/deploy/provision-machine-credential.sh
@@ -32,7 +32,7 @@ if [[ "$ACTION" == "rotate" ]]; then
     owner-requested-rotation|exposure-detected) ;;
     *) echo "invalid rotation reason" >&2; exit 2 ;;
   esac
-  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane rotate -reason "$reason"
+  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane -reason "$reason" rotate
 else
   ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane ensure
 fi
diff --git a/deploy/provision-machine-credential_test.sh b/deploy/provision-machine-credential_test.sh
index 2aac842..147b208 100644
--- a/deploy/provision-machine-credential_test.sh
+++ b/deploy/provision-machine-credential_test.sh
@@ -23,6 +23,8 @@ capture="$tmp/capture"
 PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" "$tmp/repo/deploy/provision-machine-credential.sh" ensure >/dev/null
 grep -qx 'volume create assistant_control_plane_service_secrets' "$capture"
 grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane ensure' "$capture"
+PATH="$tmp/bin:$PATH" CAPTURE="$capture" REPO_DIR="$tmp/repo" ENV_FILE="$tmp/env" ROTATION_REASON=owner-requested-rotation "$tmp/repo/deploy/provision-machine-credential.sh" rotate >/dev/null
+grep -q -- '--profile secret-control-plane run --rm --no-deps secret-control-plane -reason owner-requested-rotation rotate' "$capture"
 if grep -Eqi '(token=|password=|secret=|authorization:)' "$capture"; then
   echo "provisioning wrapper passed credential material" >&2
   exit 1