diff --git a/harnesses/metadata-coverage/cmd/script/defined_auth.go b/harnesses/metadata-coverage/cmd/script/defined_auth.go
index 717e75ad..40ca7c73 100644
--- a/harnesses/metadata-coverage/cmd/script/defined_auth.go
+++ b/harnesses/metadata-coverage/cmd/script/defined_auth.go
@@ -58,6 +58,33 @@ func decodeJWTExpiration(token string) (time.Time, error) {
 	return time.Unix(claims.Exp, 0), nil
 }
 
+// tryTokenService fetches a fresh JWE from the Paris-box sidecar.
+func tryTokenService(baseURL string) (string, error) {
+	client := &http.Client{Timeout: 5 * time.Second}
+	for _, path := range []string{"/token", "/jwt", "/"} {
+		resp, err := client.Get(baseURL + path)
+		if err != nil {
+			continue
+		}
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if resp.StatusCode != 200 {
+			continue
+		}
+		var parsed struct {
+			Token string `json:"token"`
+		}
+		if err := json.Unmarshal(body, &parsed); err == nil && parsed.Token != "" {
+			return parsed.Token, nil
+		}
+		s := strings.TrimSpace(string(body))
+		if len(s) > 50 {
+			return s, nil
+		}
+	}
+	return "", fmt.Errorf("no working path on sidecar")
+}
+
 // GetDefinedJWTToken returns a cached JWT token or generates a new one if expired.
 // If CODEX_JWT env var is set, it is returned directly (bypasses session-cookie flow).
 func GetDefinedJWTToken(sessionCookie string) (string, error) {
@@ -84,6 +111,17 @@ func GetDefinedJWTToken(sessionCookie string) (string, error) {
 		return globalTokenCache.token, nil
 	}
 
+	// Sidecar (Paris box, fresh every 8 min via Tor+utls, bypasses Kasada)
+	if svcURL := os.Getenv("DEFINED_TOKEN_SERVICE_URL"); svcURL != "" {
+		if tok, err := tryTokenService(svcURL); err == nil && tok != "" {
+			fmt.Printf("[DEFINED-AUTH] Got token from sidecar (len=%d)\n", len(tok))
+			globalTokenCache.token = tok
+			globalTokenCache.expiresAt = time.Now().Add(8 * time.Minute)
+			globalTokenCache.lastRefresh = time.Now()
+			return tok, nil
+		}
+	}
+
 	// Generate new token
 	token, err := generateDefinedJWTToken(sessionCookie)
 	if err != nil {
diff --git a/harnesses/pm-rate-limits/cmd/script/codex_auth.go b/harnesses/pm-rate-limits/cmd/script/codex_auth.go
index a4e1fd39..2b170cd7 100644
--- a/harnesses/pm-rate-limits/cmd/script/codex_auth.go
+++ b/harnesses/pm-rate-limits/cmd/script/codex_auth.go
@@ -78,6 +78,18 @@ func GetCodexJWT(sessionCookie string) (string, error) {
 	if codexTokenCache.token != "" && time.Now().Before(codexTokenCache.expiresAt.Add(-1*time.Hour)) {
 		return codexTokenCache.token, nil
 	}
+
+	// Sidecar (Paris box, fresh every 8 min via Tor+utls, bypasses Kasada)
+	if svcURL := os.Getenv("DEFINED_TOKEN_SERVICE_URL"); svcURL != "" {
+		if tok, err := tryTokenService(svcURL); err == nil && tok != "" {
+			log.Printf("[codex-auth] Got token from sidecar (len=%d)", len(tok))
+			codexTokenCache.token = tok
+			codexTokenCache.expiresAt = time.Now().Add(8 * time.Minute)
+			codexTokenCache.lastRefresh = time.Now()
+			return tok, nil
+		}
+	}
+
 	tok, err := mintCodexJWT(sessionCookie)
 	if err != nil {
 		return "", err
@@ -101,6 +113,32 @@ func InvalidateCodexJWT() {
 	log.Printf("[codex-auth] JWT cache invalidated")
 }
 
+func tryTokenService(baseURL string) (string, error) {
+	client := &http.Client{Timeout: 5 * time.Second}
+	for _, path := range []string{"/token", "/jwt", "/"} {
+		resp, err := client.Get(baseURL + path)
+		if err != nil {
+			continue
+		}
+		body, _ := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if resp.StatusCode != 200 {
+			continue
+		}
+		var parsed struct {
+			Token string `json:"token"`
+		}
+		if err := json.Unmarshal(body, &parsed); err == nil && parsed.Token != "" {
+			return parsed.Token, nil
+		}
+		s := strings.TrimSpace(string(body))
+		if len(s) > 50 {
+			return s, nil
+		}
+	}
+	return "", fmt.Errorf("no working path on sidecar")
+}
+
 func mintCodexJWT(sessionCookie string) (string, error) {
 	// CRITICAL: route through HTTP_PROXY / HTTPS_PROXY (Webshare). Direct
 	// Railway IPs get stuck in Vercel's bot-ban loop after a few mints.