diff --git a/infra/bootstrap_supervisor.sh b/infra/bootstrap_supervisor.sh
index 87df7b8..d867483 100755
--- a/infra/bootstrap_supervisor.sh
+++ b/infra/bootstrap_supervisor.sh
@@ -26,9 +26,18 @@ if [ "$EUID" -ne 0 ]; then
 fi
 
 # Configuration
-REPO_URL="${REPO_URL:-git@gitlab.com:deemanone/materia.git}"
 MATERIA_DIR="/opt/materia"
 REPO_DIR="$MATERIA_DIR/repo"
+GITLAB_PROJECT="deemanone/materia"
+
+# GITLAB_READ_TOKEN should be set in Pulumi ESC (beanflows/prod)
+if [ -z "${GITLAB_READ_TOKEN:-}" ]; then
+    echo "ERROR: GITLAB_READ_TOKEN environment variable not set"
+    echo "Please add it to Pulumi ESC (beanflows/prod) first"
+    exit 1
+fi
+
+REPO_URL="https://gitlab-ci-token:${GITLAB_READ_TOKEN}@gitlab.com/${GITLAB_PROJECT}.git"
 
 echo "--- Installing system dependencies ---"
 apt-get update