diff --git a/main.tf b/main.tf
index 026c624..684ff6d 100644
--- a/main.tf
+++ b/main.tf
@@ -40,7 +40,8 @@ resource "docker_container" "renovate" {
       "RENOVATE_AUTODISCOVER=${var.renovate_autodiscover}",
       "LOG_LEVEL=${var.log_level}"
     ],
-    var.github_com_token != "" ? ["GITHUB_COM_TOKEN=${var.github_com_token}"] : [],
+    # GitHub token: prefer Vault, fall back to variable
+    coalesce(try(data.vault_generic_secret.renovate.data["github_token"], ""), var.github_com_token) != "" ? ["GITHUB_COM_TOKEN=${coalesce(try(data.vault_generic_secret.renovate.data["github_token"], ""), var.github_com_token)}"] : [],
     var.extra_env_vars
   )