diff --git a/bin/rotate-token.sh b/bin/rotate-token.sh
new file mode 100644
index 0000000..2cf0023
--- /dev/null
+++ b/bin/rotate-token.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Ask the relay to mint a fresh operator token and print it. Paste the result
+# into your own .env; do not commit it. Rotating invalidates the previous one.
+set -eu
+. "$(dirname "$0")/../.env"
+curl -ks -X POST \
+  -H "Authorization: Bearer ${RELAY_TOKEN}" \
+  "${RELAY_ENDPOINT}/operator/token:rotate" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p'