diff --git a/Plugin/unraid/System_Essentials/unraid_api_key_renew.sh b/Plugin/unraid/System_Essentials/unraid_api_key_renew.sh
index 56dfc85..c631823 100755
--- a/Plugin/unraid/System_Essentials/unraid_api_key_renew.sh
+++ b/Plugin/unraid/System_Essentials/unraid_api_key_renew.sh
@@ -34,7 +34,8 @@
 #   1. Check whether a Varaverk key already exists in the unraid-api registry
 #   2. Create or overwrite it — the registry is ephemeral, so re-registering is the norm
 #   3. Write the resulting key into this host's conf, replacing any previous value
-#   4. Report whether the key was created, refreshed, or unchanged
+#   4. Push the key into each partner's OWN conf, at the path their varaverk.cfg reports
+#   5. Report whether the key was created, refreshed, or unchanged
 #
 # Runs at array start. The registry does not survive OS updates or an unraid-api restart,
 # which is why this re-registers unconditionally rather than only when the key is missing —
@@ -49,6 +50,17 @@
 #   Conf file check — aborts before any writes if the host conf is missing
 #   dry-run mode    — shows what would happen without touching anything
 #
+#   Remote path discovery
+#       The partner's conf path comes from resolve_remote_scripts_dir(), which reads their
+#       varaverk.cfg, so a partner in appdata storage mode is found. The path was hardcoded
+#       to the flash plugin directory, which is wrong for any such partner.
+#
+#   Remote target must exist
+#       The pushed script refuses to create the conf and reports the path it looked at.
+#       resolve_remote_scripts_dir() falls back to our own SCRIPTS_DIR when the probe fails,
+#       and appending an API key to a merely plausible path is how the hardcoded version
+#       failed without saying so.
+#
 # ==============================================================================================
 # CONFIGURATION
 # ==============================================================================================
@@ -194,6 +206,9 @@ if [[ -z "$SSH_KEY" ]]; then
     exit 0
 fi
 
+# resolve_remote_scripts_dir() reads this; every inline timeout below already uses 10.
+SSH_TIMEOUT=10
+
 for host_var in $(compgen -v | grep -E '^HOST[0-9]+$'); do
     partner_host="${!host_var}"
     [[ -z "$partner_host" ]] && continue
@@ -203,16 +218,27 @@ for host_var in $(compgen -v | grep -E '^HOST[0-9]+$'); do
     partner_ip=$(resolve_tailscale_ip "$partner_host" 2>/dev/null || true)
     [[ -z "$partner_ip" ]] && { log "Cannot resolve IP for $partner_host — skipping"; continue; }
 
-    # Target is the partner's OWN conf on their machine
-    partner_conf="/boot/config/plugins/varaverk/Configurations/${partner_slot}.conf"
+    # Target is the partner's OWN conf on their machine. Their SCRIPTS_DIR is read from their
+    # varaverk.cfg rather than assumed — this was hardcoded to the flash plugin path, so a
+    # partner in appdata storage mode had its key appended under a directory that does not
+    # exist there. HOST2 has run in appdata mode since it was installed.
+    partner_sd=$(resolve_remote_scripts_dir "$partner_ip" "$SSH_KEY" "no")
+    partner_conf="${partner_sd}/Configurations/${partner_slot}.conf"
     tmp=$(mktemp /tmp/vv_kp_XXXXXX.sh)
     remote="/tmp/vv_kp_${RANDOM}.sh"
     chmod 700 "$tmp"
 
-    # Key stays in the temp file — never appears in SSH command args
+    # Key stays in the temp file — never appears in SSH command args.
+    # The conf must already exist: resolve_remote_scripts_dir falls back to our own SCRIPTS_DIR
+    # when the probe fails, and appending a key to a path that is merely plausible is how the
+    # hardcoded version failed silently. Report the path instead of guessing.
     cat > "$tmp" <<PUSHSCRIPT
 #!/bin/sh
 target='${partner_conf}'
+if [ ! -f "\$target" ]; then
+  echo "missing:\$target"
+  exit 1
+fi
 if grep -q "\b${VAR_NAME}\b" "\$target" 2>/dev/null; then
   sed -i 's|^\(\\s*${VAR_NAME}\\s*=\\s*\)"[^"]*"|\1"${KEY}"|' "\$target"
 else
@@ -223,13 +249,14 @@ PUSHSCRIPT
 
     if timeout 10 scp -i "$SSH_KEY" -o ConnectTimeout=10 -o BatchMode=yes \
         -o StrictHostKeyChecking=no "$tmp" "root@${partner_ip}:${remote}" 2>/dev/null; then
-        if timeout 10 ssh -i "$SSH_KEY" -o ConnectTimeout=10 -o BatchMode=yes \
+        push_out=$(timeout 10 ssh -i "$SSH_KEY" -o ConnectTimeout=10 -o BatchMode=yes \
             -o StrictHostKeyChecking=no "root@${partner_ip}" \
-            "bash '${remote}'; rc=\$?; rm -f '${remote}'; exit \$rc" 2>/dev/null | grep -q ok; then
-            echo "Key pushed to $partner_host ✅"
-        else
-            warn "Key push to $partner_host failed — they can create their own copy"
-        fi
+            "bash '${remote}'; rc=\$?; rm -f '${remote}'; exit \$rc" 2>/dev/null)
+        case "$push_out" in
+            *ok*)      echo "Key pushed to $partner_host ✅" ;;
+            missing:*) warn "Key push to $partner_host failed — no conf at ${push_out#missing:}" ;;
+            *)         warn "Key push to $partner_host failed — they can create their own copy" ;;
+        esac
     else
         warn "SCP to $partner_host failed — skipping"
     fi