diff --git a/cloudbuild.yaml b/cloudbuild.yaml
index 0e49945..651b08d 100644
--- a/cloudbuild.yaml
+++ b/cloudbuild.yaml
@@ -58,7 +58,7 @@ steps:
       - '--quiet'
 
   # Steg 5: Smoke test — verifiser at agenten svarer etter deploy
-  # Bruker access token fra metadata-server (fungerer i Cloud Build 2nd gen)
+  # Bruker gcloud auth print-identity-token med impersonation (løser 2nd gen token-problem)
   - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
     id: smoke-test
     waitFor: ['deploy']
@@ -67,11 +67,10 @@ steps:
       - '-c'
       - |
         echo "=== Smoke Test ==="
-        TOKEN=$$(curl -sf \
-          -H "Metadata-Flavor: Google" \
-          "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" \
-          | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])") \
-          || { echo "❌ Kunne ikke hente access token"; exit 1; }
+        TOKEN=$$(gcloud auth print-identity-token \
+          --impersonate-service-account=${_AGENT_SA} \
+          --audiences="https://${_CLOUD_RUN_URL}") \
+          || { echo "❌ Kunne ikke hente identity token"; exit 1; }
 
         RESPONSE=$$(curl -sf \
           -H "Authorization: Bearer $$TOKEN" \