diff --git a/Makefile b/Makefile
index 5042f10..a16b3d5 100644
--- a/Makefile
+++ b/Makefile
@@ -72,10 +72,12 @@ check-secrets: ## Fail if any file in secrets/ is not SOPS-encrypted
 
 # ---- Terraform (Hetzner) ----
 tf-fmt: ## Terraform fmt
-	@terraform -chdir=terraform/hetzner fmt -recursive || true
+	@[ -n "$(HCLOUD_TOKEN)" ] || (echo "HCLOUD_TOKEN empty; export SOPS_AGE_KEY or set keys.txt & fill secrets.sops.yaml" && exit 1)
+	@export HCLOUD_TOKEN=$(HCLOUD_TOKEN); @terraform -chdir=terraform/hetzner fmt -recursive || true
 
 tf-init: ## Terraform init
-	@terraform -chdir=terraform/hetzner init
+	@[ -n "$(HCLOUD_TOKEN)" ] || (echo "HCLOUD_TOKEN empty; export SOPS_AGE_KEY or set keys.txt & fill secrets.sops.yaml" && exit 1)
+	@export HCLOUD_TOKEN=$(HCLOUD_TOKEN); @terraform -chdir=terraform/hetzner init
 
 tf-plan: tf-init ## Terraform plan (requires decrypted HCLOUD_TOKEN)
 	@[ -n "$(HCLOUD_TOKEN)" ] || (echo "HCLOUD_TOKEN empty; export SOPS_AGE_KEY or set keys.txt & fill secrets.sops.yaml" && exit 1)