diff --git a/tasks/acs-ci-nightly/openshell/README.md b/tasks/acs-ci-nightly/openshell/README.md
index c165fd6..367249e 100644
--- a/tasks/acs-ci-nightly/openshell/README.md
+++ b/tasks/acs-ci-nightly/openshell/README.md
@@ -12,7 +12,9 @@ and attaches those instances; it does not provision or manage their
 credentials.
 
 The built-in Google Cloud profile supplies the gateway-managed metadata path
-that gsutil uses. The task policy binds that provider instance only to the
+that gsutil uses. The workflow's Boto configuration enables gsutil's
+`[GoogleCompute]` metadata credential lookup without placing a credential in
+the sandbox. The task policy binds that provider instance only to the
 read-only `test-platform-results-public` endpoints.
 The task also points Google Cloud CLI tools at OpenShell's combined CA bundle
 so `gsutil` verifies the sandbox proxy certificate without disabling TLS.
diff --git a/tasks/acs-ci-nightly/workflow/harness.yaml b/tasks/acs-ci-nightly/workflow/harness.yaml
index 39c83ae..9160c0f 100644
--- a/tasks/acs-ci-nightly/workflow/harness.yaml
+++ b/tasks/acs-ci-nightly/workflow/harness.yaml
@@ -37,6 +37,9 @@ payloads:
   - content: |
       [Boto]
       ca_certificates_file = /etc/openshell-tls/ca-bundle.pem
+
+      [GoogleCompute]
+      service_account = default
     destination: /tmp/openshell-boto.cfg
 
 agent:
diff --git a/tasks/acs-ci-nightly/workflow/preflight.yaml b/tasks/acs-ci-nightly/workflow/preflight.yaml
index a0b47cd..e0975ac 100644
--- a/tasks/acs-ci-nightly/workflow/preflight.yaml
+++ b/tasks/acs-ci-nightly/workflow/preflight.yaml
@@ -19,6 +19,9 @@ payloads:
   - content: |
       [Boto]
       ca_certificates_file = /etc/openshell-tls/ca-bundle.pem
+
+      [GoogleCompute]
+      service_account = default
     destination: /tmp/openshell-boto.cfg
 
 agent: