diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b2a2e9b1..14c27749 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -80,7 +80,7 @@ overrides:
   js-yaml@^3: 3.15.1
   js-yaml@4: 4.3.1
   mermaid: 11.16.1
-  nanoid@<3.3.17: 3.3.17
+  nanoid@<3.3.18: 3.3.18
   ox: 0.14.30
   postcss: 8.5.23
   protobufjs: 7.6.5
@@ -9039,8 +9039,8 @@ packages:
   nan@2.24.0:
     resolution: {integrity: sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==}
 
-  nanoid@3.3.17:
-    resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==}
+  nanoid@3.3.18:
+    resolution: {integrity: sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -23668,7 +23668,7 @@ snapshots:
   nan@2.24.0:
     optional: true
 
-  nanoid@3.3.17: {}
+  nanoid@3.3.18: {}
 
   negotiator@0.6.3: {}
 
@@ -24509,7 +24509,7 @@ snapshots:
 
   postcss@8.5.23:
     dependencies:
-      nanoid: 3.3.17
+      nanoid: 3.3.18
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 3f21b0a7..67ec5bda 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -76,7 +76,7 @@ minimumReleaseAgeExclude:
   - ip-address@10.3.1
   - js-yaml@3.15.1
   - js-yaml@4.3.1
-  - nanoid@3.3.17
+  - nanoid@3.3.18
   - postcss@8.5.23
   - socket.io-parser@4.2.7
   - undici@7.29.0
@@ -132,7 +132,8 @@ overrides:
   js-yaml@^3: '3.15.1'
   js-yaml@4: '4.3.1'
   mermaid: '11.16.1'
-  'nanoid@<3.3.17': '3.3.17'
+  # GHSA-2v37-7h3g-55p8: custom generators can loop indefinitely when size is zero.
+  'nanoid@<3.3.18': '3.3.18'
   ox: 0.14.30
   postcss: '8.5.23'
   protobufjs: '7.6.5'
diff --git a/site/src/pages/docs/cli/provider.mdx b/site/src/pages/docs/cli/provider.mdx
index a1c9b739..fe73c35a 100644
--- a/site/src/pages/docs/cli/provider.mdx
+++ b/site/src/pages/docs/cli/provider.mdx
@@ -50,6 +50,11 @@ await connect(client, { // [!code focus]
         selector: 'transfer(address,uint256)', // [!code focus]
       }], // [!code focus]
     }, // [!code focus]
+    showDeposit: { // [!code focus]
+      amount: '10', // [!code focus]
+      displayName: 'My CLI', // [!code focus]
+      token: 'MACHUSD', // [!code focus]
+    }, // [!code focus]
   }, // [!code focus]
 }) // [!code focus]
 ```
diff --git a/site/src/pages/docs/guides/deposits.mdx b/site/src/pages/docs/guides/deposits.mdx
index 4e2a92b3..4747e7e5 100644
--- a/site/src/pages/docs/guides/deposits.mdx
+++ b/site/src/pages/docs/guides/deposits.mdx
@@ -169,6 +169,10 @@ connect.connect({
 
 :::
 
+Use `token: 'MACHUSD'` the same way as `pathUSD` or `USDC.e`. Accounts forwards
+the token symbol through the reusable Tempo Wallet iframe, which selects the
+matching deposit flow.
+
 ## Next Steps
 
 <Cards>
diff --git a/src/core/Dialog.browser.test.ts b/src/core/Dialog.browser.test.ts
index 94d7d1a3..67a93aaf 100644
--- a/src/core/Dialog.browser.test.ts
+++ b/src/core/Dialog.browser.test.ts
@@ -72,6 +72,7 @@ describe('Dialog.iframe', () => {
     const allow = iframe.getAttribute('allow')!
     expect(allow).toContain('publickey-credentials-get')
     expect(allow).toContain('publickey-credentials-create')
+    expect(allow).toContain('payment *')
   })
 
   test('behavior: iframe src points to host', () => {
diff --git a/src/core/Dialog.ts b/src/core/Dialog.ts
index 9d39aa7e..3cbf2e94 100644
--- a/src/core/Dialog.ts
+++ b/src/core/Dialog.ts
@@ -167,7 +167,7 @@ export function iframe(): Dialog {
         `publickey-credentials-get ${hostUrl.origin}`,
         `publickey-credentials-create ${hostUrl.origin}`,
         'clipboard-write',
-        'payment',
+        'payment *',
       ].join('; '),
     )
     frame.setAttribute('allowtransparency', 'true')
diff --git a/src/core/adapters/postMessage/mount.test.ts b/src/core/adapters/postMessage/mount.test.ts
index 484acbd5..07e0da71 100644
--- a/src/core/adapters/postMessage/mount.test.ts
+++ b/src/core/adapters/postMessage/mount.test.ts
@@ -36,7 +36,7 @@ describe('auto', () => {
     vi.stubGlobal('window', {
       isSecureContext: true,
       location: {
-        hostname: 'app.polyhedge.capital',
+        hostname: 'mercator.tempoxyz.dev',
         protocol: 'https:',
       },
     })
diff --git a/src/core/adapters/postMessage/mount.ts b/src/core/adapters/postMessage/mount.ts
index 663d3522..4c1d2a05 100644
--- a/src/core/adapters/postMessage/mount.ts
+++ b/src/core/adapters/postMessage/mount.ts
@@ -122,7 +122,7 @@ export function iframe(): Factory {
           `publickey-credentials-get ${origin}`,
           `publickey-credentials-create ${origin}`,
           'clipboard-write',
-          'payment',
+          'payment *',
         ].join('; '),
       )
       frame.setAttribute('allowtransparency', 'true')
diff --git a/src/trusted-hosts.json b/src/trusted-hosts.json
index effbc270..75c02a9c 100644
--- a/src/trusted-hosts.json
+++ b/src/trusted-hosts.json
@@ -13,6 +13,7 @@
     "*.porto.workers.dev",
     "benedict.dev",
     "papercut.lol",
+    "mercator.tempoxyz.dev",
     "tempo-docs-git-jxom-accounts-sdk-docs-tempoxyz.vercel.app",
     "appkit-wagmi-tempo-wallet.vercel.app",
     "tip.bot",