diff --git a/apps/api/src/agent-scripts/mikrotik-install.rsc b/apps/api/src/agent-scripts/mikrotik-install.rsc
index 4199e97..038aed5 100644
--- a/apps/api/src/agent-scripts/mikrotik-install.rsc
+++ b/apps/api/src/agent-scripts/mikrotik-install.rsc
@@ -24,9 +24,10 @@
 } on-error={}
 
 :if ($already = 0) do={
-  :local token ("evofw_" . [/certificate scep-server nonce generate])
+  # Portable token: :rndstr is RouterOS 7+; avoid /certificate scep-server nonce (often missing).
+  :local token ("evofw_" . [:rndstr length=32 from="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"])
   :if ([:len $token] < 20) do={
-    :set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]] . [:tostr [/system resource get free-memory]])
+    :set token ("evofw_" . [:tostr [/system clock get time]] . [:tostr [/system resource get cpu-load]] . [:tostr [/system resource get free-memory]] . [:tostr [:rndnum from=100000 to=999999]])
   }
 
   :local body ("{\"name\":\"" . $EvofwName . "\",\"hostname\":\"" . [/system identity get name] . "\",\"platform\":\"mikrotik\",\"token\":\"" . $token . "\",\"client_version\":\"rsc/1\"")