diff --git a/install-stack.sh b/install-stack.sh
index d788e2d..2409ca5 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -909,6 +909,13 @@ deploy_settings() {
   install_mgmt_key 116
   msg_ok "Docker + SSH ready"
 
+  # Copy the shared deploy SSH key so settings can SSH into the MQTT broker
+  # LXC (104) to manage dynamic-security clients — same mechanism management
+  # uses for its Shell/exec tab, just consumed by a second container.
+  pct exec 116 -- mkdir -p /root/.ssh
+  pct push 116 /root/.ssh/hotel-manage_deploy /root/.ssh/hotel-manage_deploy &>/dev/null
+  pct exec 116 -- chmod 600 /root/.ssh/hotel-manage_deploy
+
   msg_info "Deploying settings service"
   deploy_service 116 "settings" "${REPO_ROOT}/settings" /opt/settings
 
@@ -917,6 +924,9 @@ NODE_ENV=production
 DATABASE_URL=postgresql://settings:${SETTINGS_DB_PASS}@10.10.10.100:5432/settings_db
 SETTINGS_SECRET=${SETTINGS_SECRET}
 AUTH_URL=http://10.10.10.101:3001
+MQTT_BROKER_HOST=10.10.10.104
+MQTT_ADMIN_USER=${MQTT_ADMIN_USER:-}
+MQTT_ADMIN_PASS=${MQTT_ADMIN_PASS:-}
 EOF
 
   pct exec 116 -- bash -c "cd /opt/settings && docker compose up -d --build" &>/dev/null
@@ -2488,6 +2498,9 @@ deploy_portal
 deploy_npm
 deploy_management
 deploy_noticeboard
+# mqtt-broker before settings: settings' own deploy threads MQTT_ADMIN_USER/PASS
+# into its .env, which only exist in the creds file once the broker has run.
+deploy_mqtt_broker
 deploy_settings
 deploy_cashup
 deploy_hk_planner
@@ -2501,7 +2514,6 @@ deploy_reports
 deploy_kitchen
 deploy_kds
 deploy_wages
-deploy_mqtt_broker
 deploy_hvac
 deploy_calendar
 configure_npm_proxy_hosts