diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go
new file mode 100644
index 00000000..0b117768
--- /dev/null
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_entry_keys_test.go
@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// Issue 945: the SDK names the vault's credential of a bound entry `vault-name`, and the state guard refuses an entry
+// written under the old key `credential`. The client never reads that key, but a fixture that carries it is a bound
+// entry the mesh would refuse, so no fixture of this client writes one.
+func TestNoFixtureCarriesABoundEntryKeyTheStateGuardRefuses(t *testing.T) {
+	files, err := filepath.Glob("*_test.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := `"credential"` + `:"pair/` // a bound entry's credential, under its old key
+	for _, f := range files {
+		raw, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(string(raw), old) {
+			t.Errorf("%s has a bound entry with the key credential; the SDK names it vault-name (issue 945)", f)
+		}
+	}
+}
diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
index 23664ee4..c7ed03eb 100644
--- a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/bound_gitea_test.go
@@ -63,7 +63,7 @@ func giteaRun(t *testing.T, entry string, extra string) (*engine, *aBus, *report
 func TestNatsAHandedGiteasServerEnvIsFilledAsTheControllerComposedIt(t *testing.T) {
 	e, _, _ := giteaRun(t, `{"provider":"novox","provider-module":"postgres","provision":"postgres-database",`+
 		`"consumer":"g14","module":"gitea","as":"mesh_g14_gitea","user":"mesh_g14_gitea",`+
-		`"values":{"at":"10.7.0.1","from":"novox","port":5432},"credential":"pair/novox/postgres-database/g14/gitea"}`,
+		`"values":{"at":"10.7.0.1","from":"novox","port":5432},"vault-name":"pair/novox/postgres-database/g14/gitea"}`,
 		"FROM=${bound:postgres-database:from}\n")
 	eventually(t, "server.env is filled to the controller's text", func() bool {
 		return e.read(t, giteaEnvPath) == giteaBoundExpected("tok-never-on-the-bus", "pw-never-on-the-bus")+"FROM=novox\n"
diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go
index 469e4396..b6a75b20 100644
--- a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/consumers_test.go
@@ -224,7 +224,7 @@ func TestNatsAConsumersBoundValuesAreFilledFromItsProvidersEntry(t *testing.T) {
 	})
 	b.put(t, "postgres_bound", node+".app.postgres-database", `{"provider":"novox","provider-module":"postgres",`+
 		`"provision":"postgres-database","consumer":"g14","module":"app","as":"mesh_g14_app","user":"mesh_g14_app",`+
-		`"values":{"host":"novox.mesh","port":5432},"credential":"pair/novox/postgres-database/g14/app"}`)
+		`"values":{"host":"novox.mesh","port":5432},"vault-name":"pair/novox/postgres-database/g14/app"}`)
 	eventually(t, "the file is filled from its provider's entry", func() bool {
 		return e.read(t, appBound) == "HOST=novox.mesh\nPORT=5432\nUSER=mesh_g14_app\n"
 	})
diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
index 848227ef..882670f9 100644
--- a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
+++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/moved_forge_test.go
@@ -86,7 +86,7 @@ func TestNatsAMovedGiteaAndClaudeCodeHaveTheirFilesFilledFromTheBus(t *testing.T
 	}
 	b.put(t, "postgres_bound", node+".gitea.postgres-database", `{"provider":"novox","provider-module":"postgres",`+
 		`"provision":"postgres-database","consumer":"g14","module":"gitea","as":"mesh_g14_gitea","user":"mesh_g14_gitea",`+
-		`"values":{"at":"10.7.0.1","from":"novox","port":5432},"credential":"pair/novox/postgres-database/g14/gitea"}`)
+		`"values":{"at":"10.7.0.1","from":"novox","port":5432},"vault-name":"pair/novox/postgres-database/g14/gitea"}`)
 	b.put(t, "route-proxy_bound", node+".gitea.route", `{"provider":"novox","provider-module":"route-proxy",`+
 		`"provision":"route","consumer":"g14","module":"gitea","as":"mesh_g14_gitea",`+
 		`"values":{"name":"git.example.org","internal-name":"git.novox.internal","name-web":"git.example.org"}}`)