diff --git a/rook-ceph/kustomization.yaml b/rook-ceph/kustomization.yaml
index b70877f..bbb083d 100644
--- a/rook-ceph/kustomization.yaml
+++ b/rook-ceph/kustomization.yaml
@@ -66,3 +66,16 @@ resources:
 # - ssh://git@git.k-space.ee/secretspace/kube/rook-ceph # secrets: rook-ceph-external-admin-secret
 - ./storage-classes.yaml
 
+patches:
+# External cluster has no client.admin - make bare ceph/rbd commands in the
+# toolbox default to the connected (healthchecker) user.
+- target:
+    kind: Deployment
+    name: rook-ceph-tools
+  patch: |-
+    - op: add
+      path: /spec/template/spec/containers/0/env/-
+      value:
+        name: CEPH_ARGS
+        value: -n $(ROOK_CEPH_USERNAME)
+