diff --git a/extensions/pi-remote-control/html.ts b/extensions/pi-remote-control/html.ts
index 4e624c5..d06280f 100644
--- a/extensions/pi-remote-control/html.ts
+++ b/extensions/pi-remote-control/html.ts
@@ -5,7 +5,7 @@
  * Everything is self-contained — no external dependencies.
  */
 
-export function buildHTML(nonce: string): string {
+export function buildHTML(nonce: string, token?: string): string {
 return /* html */ `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -398,6 +398,7 @@ return /* html */ `<!DOCTYPE html>
   </div>
 </div>
 <script nonce="${nonce}">
+(function(){var _rcToken="${token || ''}";})();
 (function () {
   "use strict";
 
@@ -605,7 +606,11 @@ return /* html */ `<!DOCTYPE html>
   var ws, timer;
   function connect() {
     var wsProtocol = location.protocol === "https:" ? "wss:" : "ws:";
-    ws = new WebSocket(wsProtocol + "//" + location.host + "/ws");
+    var wsUrl = wsProtocol + "//" + location.host + "/ws";
+    if (typeof _rcToken !== "undefined" && _rcToken) {
+      wsUrl += "?token=" + encodeURIComponent(_rcToken);
+    }
+    ws = new WebSocket(wsUrl);
 
     ws.onopen = function () {
       clearTimeout(timer);
diff --git a/extensions/pi-remote-control/server.ts b/extensions/pi-remote-control/server.ts
index 9d5e058..506fe5f 100644
--- a/extensions/pi-remote-control/server.ts
+++ b/extensions/pi-remote-control/server.ts
@@ -126,7 +126,7 @@ export function startServer(pi: ExtensionAPI, ctx: ExtensionContext): Promise<Re
 				"Content-Security-Policy":
 					`default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'`,
 			});
-			res.end(buildHTML(nonce));
+			res.end(buildHTML(nonce, token));
 		} else {
 			res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
 			res.end("Not found");
@@ -350,7 +350,7 @@ export function startServerTailscale(pi: ExtensionAPI, ctx: ExtensionContext): P
 				"Content-Security-Policy":
 					`default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'`,
 			});
-			res.end(buildHTML(nonce));
+			res.end(buildHTML(nonce, token));
 		} else {
 			res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
 			res.end("Not found");
