diff --git a/containers/stoat/scripts/stoat_install_hooks.sh b/containers/stoat/scripts/stoat_install_hooks.sh
index ad2d160..f6ebdfa 100644
--- a/containers/stoat/scripts/stoat_install_hooks.sh
+++ b/containers/stoat/scripts/stoat_install_hooks.sh
@@ -118,6 +118,17 @@ worldwide = "${ws_scheme}://${hostport}/livekit"
 url = "http://livekit:7880"
 lat = 0.0
 lon = 0.0
+
+# Upstream's built-in defaults are rabbituser/rabbitpass. The compose gives the
+# broker a generated password instead, so the clients have to be told — without
+# this the API, crond, pushd and voice-ingress all panic on ACCESS_REFUSED and
+# restart forever, while the services that do not touch RabbitMQ come up fine
+# and make it look like a partial success.
+[rabbit]
+host = "rabbit"
+port = 5672
+username = "stoat"
+password = "${rabbit_pass}"
 EOF
 
     if [[ -n "$video_enabled" ]]; then
@@ -207,7 +218,7 @@ stoat_install_post_compose()
     # domain; stoat_install_post_start rewrites these once it is known.
     local base
     base=$(_stoatBaseUrl "$app_name")
-    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled"
+    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" "$CFG_STOAT_RABBITMQ_PASSWORD_1"
     checkSuccess "Writing .env.web, stoat.json and Revolt.toml for $base"
 
     _stoatWriteSecrets "$app_dir/secrets.env"
@@ -282,7 +293,7 @@ stoat_install_post_start()
 
     local video_enabled=""
     [[ "$CFG_STOAT_ENABLE_VIDEO" != "false" ]] && video_enabled="true"
-    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled"
+    _stoatWriteUrlFiles "$app_dir" "$base" "$video_enabled" "$CFG_STOAT_RABBITMQ_PASSWORD_1"
     runFileOp chown -R "$docker_install_user":"$docker_install_user" "$app_dir"
     isSuccessful "Public URL settled as $base (was ${current:-unset})"