diff --git a/cmd/secret-control-plane/main.go b/cmd/secret-control-plane/main.go
index 7b3ab0f..2948eff 100644
--- a/cmd/secret-control-plane/main.go
+++ b/cmd/secret-control-plane/main.go
@@ -22,7 +22,11 @@ func main() {
 	if flag.NArg() != 1 {
 		fail("usage: secret-control-plane [ensure|rotate]")
 	}
-	store, err := platformsecrets.NewLocalMachineCredentialStore(defaultRoot, defaultRuntimeUID, defaultRuntimeGID, nil)
+	root := os.Getenv("SECRET_CONTROL_PLANE_ROOT")
+	if root == "" {
+		root = defaultRoot
+	}
+	store, err := platformsecrets.NewLocalMachineCredentialStore(root, defaultRuntimeUID, defaultRuntimeGID, nil)
 	if err != nil {
 		fail("control-plane credential store unavailable")
 	}
diff --git a/deploy/docker-compose.prod.yml b/deploy/docker-compose.prod.yml
index d5628f3..1eb25b9 100644
--- a/deploy/docker-compose.prod.yml
+++ b/deploy/docker-compose.prod.yml
@@ -266,6 +266,7 @@ services:
     command: ["ensure"]
     volumes:
       - assistant_control_plane_service_secrets:/run/control-plane-secrets
+      - assistant_core_secrets:/run/core-secrets
 
   cognitive-worker:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: cognitive-worker, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
diff --git a/deploy/provision-machine-credential.sh b/deploy/provision-machine-credential.sh
index 6d9c94b..c8e5390 100644
--- a/deploy/provision-machine-credential.sh
+++ b/deploy/provision-machine-credential.sh
@@ -10,6 +10,12 @@ COMPOSE_FILE="$REPO_DIR/deploy/docker-compose.prod.yml"
 VOLUME="assistant_control_plane_service_secrets"
 ACTION="${1:-ensure}"
 CREDENTIAL="${MACHINE_CREDENTIAL:-control-plane}"
+SECRET_ROOT="/run/control-plane-secrets"
+VOLUME="assistant_control_plane_service_secrets"
+if [[ "$CREDENTIAL" == "acceptance-harness" ]]; then
+  SECRET_ROOT="/run/core-secrets"
+  VOLUME="assistant_core_secrets"
+fi
 
 case "$ACTION" in
   ensure|rotate) ;;
@@ -33,7 +39,7 @@ if [[ "$ACTION" == "rotate" ]]; then
     owner-requested-rotation|exposure-detected) ;;
     *) echo "invalid rotation reason" >&2; exit 2 ;;
   esac
-  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane -credential "$CREDENTIAL" -reason "$reason" rotate
+  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" -reason "$reason" rotate
 else
-  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps secret-control-plane -credential "$CREDENTIAL" ensure
+  ASSISTANT_SOURCE_REVISION="$revision" compose --profile secret-control-plane run --rm --no-deps -e "SECRET_CONTROL_PLANE_ROOT=$SECRET_ROOT" secret-control-plane -credential "$CREDENTIAL" ensure
 fi