diff --git a/CHANGELOG.md b/CHANGELOG.md
index d2da02b..80fe7bd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,17 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.46.0] - 2026-08-07
+
+Rolls up **theta-agent v1.6.0**, **sso-manager-node v1.31.0**, **jump-host v1.19.1**.
+
+### Added
+- **On-demand CLI Secret Fetching.** `theta-agent get-secret <key>` and `theta-agent get-secrets [--env|--json]` for dynamic secret resolution without plaintext files on disk.
+- **Resource Secrets Engine & Zero-View Security.** OpenBao KV-v2 encrypted secrets for directory resources with strict regex validation (`^[A-Za-z0-9_]+$`), password generator, and multi-level hierarchy secret inheritance.
+- **OpenBao `sso-broker` Policy.** Granted `secret/data/resources/*` and `secret/metadata/resources/*` permissions to `sso-broker`.
+- **Zero-Trust LDAP WebSocket Tunnel.** Auto-starts local `/run/theta/ldap.sock` and `127.0.0.1:3890` loopback listeners on managed nodes.
+- **Agent Self-Update & Service Control.** Added `theta-agent update` and `theta-agent reinitialize` CLI commands with automated service restarts (`sssd`, `sshd`).
+
 ## [v1.45.0] - 2026-08-06
 
 Rolls up **sso-manager-node v1.30.2**, **proxy v1.35.1**, **jump-host v1.19.1**.
diff --git a/bootstrap/bootstrap.js b/bootstrap/bootstrap.js
index c3a3986..d2826e9 100644
--- a/bootstrap/bootstrap.js
+++ b/bootstrap/bootstrap.js
@@ -642,24 +642,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		requestable: false,
 	});
 
-	// OpenBao and its renewer sidecar are part of what the stack deploys, so
-	// they belong in the directory like every other component. Without entries
-	// their containers had nowhere to attach and showed up as parentless
-	// discoveries on a fresh install.
-	await ensure('service', 'OpenBao', 'openbao', host.id, {
-		address: 'http://openbao:8200',
-		port: 8200,
-		subType: 'vault',
-		icon: 'mdi:safe',
-		tagline: 'Secrets store for the stack.',
-		requestable: false,
-	});
-	await ensure('service', 'Bao Renewer', 'bao-renewer', host.id, {
-		subType: 'sidecar',
-		icon: 'mdi:autorenew',
-		tagline: 'Renews the stack service tokens against OpenBao.',
-		requestable: false,
-	});
+	// Remove legacy OpenBao/bao-renewer seed resources if present — OpenBao is an
+	// internal stack service, not a user-facing published directory service.
+	const openbaoRes = resources.find((r) => r.slug === 'openbao');
+	const renewerRes = resources.find((r) => r.slug === 'bao-renewer');
+	if (openbaoRes) await dirDelete(token, `resources/${openbaoRes.id}`);
+	if (renewerRes) await dirDelete(token, `resources/${renewerRes.id}`);
 
 	// SSH jump host service (core component — always registered).
 	let jumpSvc = null;
diff --git a/setup.sh b/setup.sh
index 7c6b91a..08d0652 100755
--- a/setup.sh
+++ b/setup.sh
@@ -929,6 +929,8 @@ path "secret/metadata/agent/*" { capabilities = ["list", "read", "delete"] }
 # Node-scoped secrets for theta-agent (DESIGN.md §5): each node reads only its
 # own secret/data/nodes/<agent-id>/* subtree via the SSO's /api/v1/agent/secrets
 # endpoint. The SSO (sso-broker) must be able to read them on the agent's behalf.
+path "secret/data/resources/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata/resources/*" { capabilities = ["list", "read", "delete"] }
 path "secret/data/nodes/*" { capabilities = ["create", "read", "update", "delete", "list"] }
 path "secret/metadata/nodes/*" { capabilities = ["list", "read", "delete"] }
 path "auth/token/create/sso-broker" { capabilities = ["update"] }