diff --git a/.env.rust.prod.example b/.env.rust.prod.example
index c6095da..44bc26d 100644
--- a/.env.rust.prod.example
+++ b/.env.rust.prod.example
@@ -70,6 +70,11 @@ RUST_OWNER_COMMANDS_ENABLED=true
 RUST_BROWSER_API_ENABLED=true
 RUST_DASHBOARD_ENABLED=true
 RUST_ADMIN_API_ENABLED=true
+# The owner console lives in the Vozen Helper GitHub Pages repo and signs in
+# through that Discord application. Keep this explicit: falling back to CLIENT_ID
+# binds admin login to the Vozen bot application and rejects every Helper OAuth token.
+ADMIN_CLIENT_ID=1526211106081734666
+ADMIN_PANEL_ORIGIN=https://rexy40407.github.io
 
 # Rust serves the existing reverse-proxy/API port after Node is stopped.
 HEALTH_PORT=3001
diff --git a/site-tests/operationalHardening.test.mjs b/site-tests/operationalHardening.test.mjs
index 61ec3be..232bd8e 100644
--- a/site-tests/operationalHardening.test.mjs
+++ b/site-tests/operationalHardening.test.mjs
@@ -50,6 +50,13 @@ describe('operational security configuration', () => {
     expect(deploy).toContain('Missing VPS_SSH_KEY');
     expect(deploy).toContain('debug: true');
   });
+  it('binds the owner console to the Helper OAuth application in production', () => {
+    const productionEnv = source('.env.rust.prod.example');
+    expect(productionEnv).toContain('ADMIN_CLIENT_ID=1526211106081734666');
+    expect(productionEnv).toContain(
+      'ADMIN_PANEL_ORIGIN=https://rexy40407.github.io',
+    );
+  });
   it('keeps the Night Signal treatment scoped to Discord entry points', () => {
     const css = source(SITE_CSS);
     const index = source('site/index.html');