diff --git a/piawg.sh b/piawg.sh
index 3ee1292..89fcc6b 100755
--- a/piawg.sh
+++ b/piawg.sh
@@ -8,7 +8,10 @@
 msg() { printf '[%s]: %s\n' "${2-INFO}" "$1"; }
 info() { [ "$PIAWG_VERBOSE" -eq 1 ] && msg "$1"; }
 warn() { msg "$1" 'WARN'; }
-err() { msg "$1" 'ERROR'; exit 1; }
+err() {
+	msg "$1" 'ERROR'
+	exit 1
+}
 
 check_http() { [ "$1" = "${2:-200}" ] && return 0 || return 1; }
 check_token() { printf '%s\n' "$1" | grep -q '^[0-9A-Fa-f]\{128\}$'; }
@@ -72,6 +75,7 @@ pia_addkey() {
 	local port
 	local peer_ip
 	local updates
+	local server_vip
 	# Add pubkey via PIA API and get connection details
 	info "Adding '$piawg_pubkey' to PIA server $server_cn"
 	if ! response=$(
@@ -86,6 +90,8 @@ pia_addkey() {
 	[ "$(printf '%s' "$response" | jq -r '.status')" != "OK" ] &&
 		err "Failed to addKey to $server_cn"
 
+	msg "$(echo "$response" | jq .)" 'DEBUG'
+
 	# Update Wireguard config on OPNsense
 	updates='{}'
 	if [ "$server_ip" != "$piawgsrv_srvaddr" ]; then
@@ -127,6 +133,11 @@ pia_addkey() {
 		err "Failed to reload Wireguard service"
 	fi
 
+	server_vip="$(printf '%s' "$response" | jq -r '.server_vip')"
+	info "Updating OpenBao server_vip at $BAO_PATH_CONFIG to $server_vip"
+	bao_curl "$BAO_KV_MOUNT/data/$BAO_PATH_CONFIG" -X POST \
+		-d "$(jq -n --arg ip "$server_vip" '{data:{server_vip:$ip}}')"
+
 	# Update firewall rule alias
 	piawg_ip_alias="$(opn_curl 'firewall/alias/searchItem' -d '{}' |
 		jq -r ".rows[] | select(.name == \"$OPN_ALIAS\") | .uuid")"