diff --git a/scripts/cf_maildesk_cf_lifecycle.py b/scripts/cf_maildesk_cf_lifecycle.py
index e722ec0..7018144 100644
--- a/scripts/cf_maildesk_cf_lifecycle.py
+++ b/scripts/cf_maildesk_cf_lifecycle.py
@@ -470,7 +470,7 @@ def sender_readback_available(sender: dict[str, Any]) -> bool:
 def sender_domain_enable_plan_command(domain: str) -> str:
     quoted_domain = shlex.quote(domain)
     return (
-        "cfctl apply sender_domain enable "
+        "CF_TOKEN_LANE=global cfctl apply sender_domain enable "
         f"--zone {quoted_domain} --name {quoted_domain} --plan"
     )
 
diff --git a/scripts/verify_maildesk_cf_contract.sh b/scripts/verify_maildesk_cf_contract.sh
index d13a905..cab4ed5 100755
--- a/scripts/verify_maildesk_cf_contract.sh
+++ b/scripts/verify_maildesk_cf_contract.sh
@@ -194,7 +194,7 @@ jq -e '
   and .readiness.mail_ready == false
   and (.drift_classes | index("sender_domain_drift")) != null
   and (.drift_classes | index("provider_status_unavailable")) == null
-  and any(.plan.operations[]; .surface == "sender_domain" and .preview_command == "cfctl apply sender_domain enable --zone example.com --name example.com --plan" and .blocked == null)
+  and any(.plan.operations[]; .surface == "sender_domain" and .preview_command == "CF_TOKEN_LANE=global cfctl apply sender_domain enable --zone example.com --name example.com --plan" and .blocked == null)
 ' "${unverified_sender_artifact_path}" >/dev/null || die "unverified sender-domain drift contract did not match"
 
 cfctl_output="$(