diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
index 78579ac..0834ece 100755
--- a/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/vault-kms.sh
@@ -106,11 +106,14 @@ vault_kms_pubkey() {
       echo "vault-kms: pubkey fetch failed (key=$key)" >&2; exit 1
     }
 
-  python3 - "$output" <<PY
+  local tmp_resp
+  tmp_resp=$(mktemp)
+  printf '%s' "$response" > "$tmp_resp"
+  python3 - "$output" "$tmp_resp" <<'PY'
 import sys, json
 output = sys.argv[1]
-response = """$response"""
-d = json.loads(response)
+with open(sys.argv[2]) as f:
+    d = json.loads(f.read())
 keys = d["data"]["keys"]
 # keys is a dict; pick the latest version
 latest = max(keys.keys(), key=lambda k: int(k))
@@ -119,6 +122,7 @@ with open(output, "w") as f:
     f.write(pub if pub.endswith("\n") else pub + "\n")
 print(f"vault-kms: public key written to {output}", file=sys.stderr)
 PY
+  rm -f "$tmp_resp"
 }
 
 # ── Verify a signature ────────────────────────────────────────────────────