diff --git a/install-stack.sh b/install-stack.sh
index 350743f..3314d9d 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -1080,15 +1080,42 @@ print(json.dumps(locs))
 # ════════════════════════════════════════════════════════════════════════════
 
 # Returns a Bearer token for the NPM API, or empty string on failure.
+# Robust against a messy creds file: tries the currently-sourced NPM_ADMIN_*
+# pair, then EVERY email/pass pair found in the creds file (handles duplicates,
+# ordering, and stale placeholders), then the NPM factory default.
 npm_get_token() {
   local npm_ip="10.10.10.3"   # stable internal NPM IP (vmbr1) — API only needs internal reach
-  local email="${NPM_ADMIN_EMAIL:-manage@hotel.com}"
-  local pass="${NPM_ADMIN_PASS:-}"
-  [[ -z "$pass" ]] && { echo ""; return; }
-  curl -sf -X POST "http://${npm_ip}:81/api/tokens" \
-    -H "Content-Type: application/json" \
-    -d "{\"identity\":\"${email}\",\"secret\":\"${pass}\"}" \
-    2>/dev/null | grep -o '"token":"[^"]*"' | cut -d'"' -f4 || echo ""
+
+  _try_token() {
+    local email=$1 pass=$2 tok
+    [[ -z "$email" || -z "$pass" ]] && return 1
+    tok=$(curl -sf -X POST "http://${npm_ip}:81/api/tokens" \
+      -H "Content-Type: application/json" \
+      -d "{\"identity\":\"${email}\",\"secret\":\"${pass}\"}" \
+      2>/dev/null | grep -o '"token":"[^"]*"' | cut -d'"' -f4)
+    [[ -n "$tok" ]] && { echo "$tok"; return 0; }
+    return 1
+  }
+
+  # 1. Currently-sourced pair
+  _try_token "${NPM_ADMIN_EMAIL:-}" "${NPM_ADMIN_PASS:-}" && return
+
+  # 2. Every email→pass pair in the creds file (pair each EMAIL with the
+  #    NPM_ADMIN_PASS that follows it)
+  if [[ -f "$CREDS_FILE" ]]; then
+    local email="" line key val
+    while IFS= read -r line; do
+      case "$line" in
+        NPM_ADMIN_EMAIL=*) email="${line#*=}" ;;
+        NPM_ADMIN_PASS=*)  _try_token "$email" "${line#*=}" && return; email="" ;;
+      esac
+    done < "$CREDS_FILE"
+  fi
+
+  # 3. NPM factory default (fresh, unconfigured install)
+  _try_token "admin@example.com" "changeme" && return
+
+  echo ""
 }
 
 configure_npm_proxy_hosts() {