Pair weldctl with this account

Generate a 90-day CLI bearer + a passphrase-wrapped copy of your vault key. You'll paste both into weldctl hub login --bundle <…> on the machine where you want to use the hub.

The CLI bearer is a long-lived credential. The passphrase you choose here is the only thing standing between someone with read access to ~/.weldctl/hub.json and your encrypted repos — pick well, and don't store it in the same place as the bundle.