diff --git a/piawg.sh b/piawg.sh
index 3ee1292..c3f5bfc 100755
--- a/piawg.sh
+++ b/piawg.sh
@@ -8,7 +8,10 @@
 msg() { printf '[%s]: %s\n' "${2-INFO}" "$1"; }
 info() { [ "$PIAWG_VERBOSE" -eq 1 ] && msg "$1"; }
 warn() { msg "$1" 'WARN'; }
-err() { msg "$1" 'ERROR'; exit 1; }
+err() {
+	msg "$1" 'ERROR'
+	exit 1
+}
 
 check_http() { [ "$1" = "${2:-200}" ] && return 0 || return 1; }
 check_token() { printf '%s\n' "$1" | grep -q '^[0-9A-Fa-f]\{128\}$'; }
@@ -24,10 +27,13 @@ bao_curl() {
 	local error
 	local http_code
 	local notfound
+	local content_type
 	notfound=0
-	while getopts "n" opt; do
+	content_type='application/json'
+	while getopts "np" opt; do
 		case "$opt" in
 		n) notfound=1 ;;
+		p) content_type='application/merge-patch+json' ;;
 		*) err "bao_curl option '$opt' not found" ;;
 		esac
 	done
@@ -35,7 +41,7 @@ bao_curl() {
 	path="$BAO_ADDR/v1/$1"
 	shift
 	error="Failed request to '$path'"
-	if ! response=$(_curl -H 'Content-Type: application/json' \
+	if ! response=$(_curl -H "Content-Type: $content_type" \
 		-H "X-Vault-Token: $bao_token" -w '\n%{http_code}' "$@" "$path"); then
 		err "$error"
 	fi
@@ -72,6 +78,7 @@ pia_addkey() {
 	local port
 	local peer_ip
 	local updates
+	local server_vip
 	# Add pubkey via PIA API and get connection details
 	info "Adding '$piawg_pubkey' to PIA server $server_cn"
 	if ! response=$(
@@ -86,6 +93,8 @@ pia_addkey() {
 	[ "$(printf '%s' "$response" | jq -r '.status')" != "OK" ] &&
 		err "Failed to addKey to $server_cn"
 
+	msg "$(echo "$response" | jq .)" 'DEBUG'
+
 	# Update Wireguard config on OPNsense
 	updates='{}'
 	if [ "$server_ip" != "$piawgsrv_srvaddr" ]; then
@@ -127,6 +136,13 @@ pia_addkey() {
 		err "Failed to reload Wireguard service"
 	fi
 
+	server_vip="$(printf '%s' "$response" | jq -r '.server_vip')"
+	info "Updating OpenBao server_vip at $BAO_PATH_CONFIG to $server_vip"
+	set -x
+	bao_curl -p "$BAO_KV_MOUNT/data/$BAO_PATH_CONFIG" -X PATCH \
+		-d "$(jq -n --arg ip "$server_vip" '{data:{server_vip:$ip}}')"
+	set +x
+
 	# Update firewall rule alias
 	piawg_ip_alias="$(opn_curl 'firewall/alias/searchItem' -d '{}' |
 		jq -r ".rows[] | select(.name == \"$OPN_ALIAS\") | .uuid")"