diff --git a/authbridge/demos/github-issue/demo-aiac.md b/authbridge/demos/github-issue/demo-aiac.md
index ae7d58bc8..c9dc19329 100644
--- a/authbridge/demos/github-issue/demo-aiac.md
+++ b/authbridge/demos/github-issue/demo-aiac.md
@@ -415,7 +415,7 @@ Authbridge outbound check will exchange the token, then deny the request since t
 
 REALM_NAME="rossoctl"
 
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/${REALM_NAME}/protocol/openid-connect/token \
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
@@ -628,7 +628,7 @@ Test the policy by getting tokens for different users:
 
 REALM_NAME="rossoctl"
 
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/${REALM_NAME}/protocol/openid-connect/token \
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
diff --git a/authbridge/demos/github-issue/demo-manual.md b/authbridge/demos/github-issue/demo-manual.md
index 8e50d891b..13af0750a 100644
--- a/authbridge/demos/github-issue/demo-manual.md
+++ b/authbridge/demos/github-issue/demo-manual.md
@@ -667,8 +667,8 @@ kubectl exec -it test-client -n team1 -- sh
 Inside the test-client pod, run:
 
 ```bash
-# Get a Keycloak admin token from the rossoctl realm
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+# Get a Keycloak admin token from the master realm (admin/admin; the rossoctl realm admin password is randomly generated)
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
@@ -896,7 +896,7 @@ Inside the test-client pod, get the agent's client credentials (needed to reques
 user tokens that include the agent's audience):
 
 ```bash
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
diff --git a/authbridge/demos/github-issue/demo-rbac.md b/authbridge/demos/github-issue/demo-rbac.md
index d2bd160b3..308de5337 100644
--- a/authbridge/demos/github-issue/demo-rbac.md
+++ b/authbridge/demos/github-issue/demo-rbac.md
@@ -667,8 +667,8 @@ kubectl exec -it test-client -n team1 -- sh
 Inside the test-client pod, run:
 
 ```bash
-# Get a Keycloak admin token from the rossoctl realm
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+# Get a Keycloak admin token from the master realm (admin/admin; the rossoctl realm admin password is randomly generated)
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
@@ -879,7 +879,7 @@ Inside the test-client pod, get the agent's client credentials (needed to reques
 user tokens that include the agent's audience):
 
 ```bash
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
diff --git a/authbridge/demos/github-issue/demo-ui.md b/authbridge/demos/github-issue/demo-ui.md
index f0956af22..0a00bc381 100644
--- a/authbridge/demos/github-issue/demo-ui.md
+++ b/authbridge/demos/github-issue/demo-ui.md
@@ -672,8 +672,8 @@ kubectl exec -it test-client -n team1 -- sh
 Inside the pod, get credentials and send a request:
 
 ```bash
-# Get a Keycloak admin token from the rossoctl realm
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+# Get a Keycloak admin token from the master realm (admin/admin; the rossoctl realm admin password is randomly generated)
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
@@ -848,7 +848,7 @@ jwt_payload() {
   echo "$p" | base64 -d
 }
 
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \
diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md
index be6741c96..3646a19f1 100644
--- a/authbridge/demos/weather-agent/demo-ui.md
+++ b/authbridge/demos/weather-agent/demo-ui.md
@@ -490,8 +490,8 @@ kubectl exec -it test-client -n team1 -- sh
 Inside the pod, get credentials and send a request:
 
 ```bash
-# Get a Keycloak admin token from the rossoctl realm
-ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token \
+# Get a Keycloak admin token from the master realm (admin/admin; the rossoctl realm admin password is randomly generated)
+ADMIN_TOKEN=$(curl -s http://keycloak-service.keycloak.svc:8080/realms/master/protocol/openid-connect/token \
   -d "grant_type=password" \
   -d "client_id=admin-cli" \
   -d "username=admin" \