diff --git a/.secrets.baseline b/.secrets.baseline
index 1e236a19e..b421b969a 100644
--- a/.secrets.baseline
+++ b/.secrets.baseline
@@ -155,7 +155,7 @@
         "filename": "brhprod/brhstaging.data-commons.org/values/values.yaml",
         "hashed_secret": "4c7e5a7eedc322089e3a64d1911d6f823431162a",
         "is_verified": false,
-        "line_number": 1190
+        "line_number": 1200
       }
     ],
     "chordsprod/chordshealth.org/values/portal.yaml": [
@@ -581,5 +581,5 @@
       }
     ]
   },
-  "generated_at": "2026-06-12T16:09:23Z"
+  "generated_at": "2026-07-14T14:27:09Z"
 }
diff --git a/brhprod/brhstaging.data-commons.org/values/values.yaml b/brhprod/brhstaging.data-commons.org/values/values.yaml
index 7fb37c5cb..9fb18e158 100644
--- a/brhprod/brhstaging.data-commons.org/values/values.yaml
+++ b/brhprod/brhstaging.data-commons.org/values/values.yaml
@@ -57,10 +57,20 @@ fence:
     fenceJwtKeys: brhstaging-fence-jwt
   image:
     repository: 707767160287.dkr.ecr.us-east-1.amazonaws.com/gen3/fence
-    tag: 'feat_scoped-token'
+    tag: 'master'
   FENCE_CONFIG_PUBLIC:
     # 2h - temporary to unblock TES testing
     ACCESS_TOKEN_EXPIRES_IN: 7200
+    # Task token types that can be requested by users.
+    ALLOWED_TASK_TOKEN_TYPES: ['WORKFLOW']
+
+    # The number of seconds after a task access token is issued until it expires.
+    # This max is applied even if the requesting user has access to request a
+    # longer-lived token in Arborist. This is configured per task token type,
+    # and falls back to MAX_ACCESS_TOKEN_TTL.
+    MAX_TASK_TOKEN_TTL:
+      WORKFLOW: 172800 # 2 days
+
 fluentd:
   enabled: true
   image: