diff --git a/.github/upstream-projects.yaml b/.github/upstream-projects.yaml
index c541ab03..94da9b3a 100644
--- a/.github/upstream-projects.yaml
+++ b/.github/upstream-projects.yaml
@@ -35,7 +35,7 @@ projects:
 
   - id: toolhive
     repo: stacklok/toolhive
-    version: v0.29.0
+    version: v0.29.1
     # toolhive is a monorepo covering the CLI, the Kubernetes
     # operator, and the vMCP gateway. It also introduces cross-
     # cutting features that land in concepts/, integrations/,
diff --git a/docs/toolhive/reference/cli/thv_llm_setup.md b/docs/toolhive/reference/cli/thv_llm_setup.md
index 95d19b01..285573b0 100644
--- a/docs/toolhive/reference/cli/thv_llm_setup.md
+++ b/docs/toolhive/reference/cli/thv_llm_setup.md
@@ -48,6 +48,7 @@ thv llm setup [flags]
       --gateway-url string             LLM gateway base URL (must use HTTPS)
   -h, --help                           help for setup
       --issuer string                  OIDC issuer URL
+      --lazy                           Skip the interactive OIDC login and defer it until the first time a configured tool accesses the gateway. Tool config and persisted settings are written normally. Useful for unattended provisioning (e.g. an MDM profile).
       --proxy-port int                 Localhost proxy listen port (omit to keep current; default: 14000)
       --tls-skip-verify                Skip TLS certificate verification for the upstream gateway (local dev only). For direct-mode tools (Claude Code, Gemini CLI) this sets NODE_TLS_REJECT_UNAUTHORIZED=0, disabling TLS for ALL of that tool's outbound connections. For proxy-mode tools only the proxy-to-gateway connection is affected.
 ```
diff --git a/docs/toolhive/reference/cli/thv_llm_token.md b/docs/toolhive/reference/cli/thv_llm_token.md
index b5a175b9..a63735e0 100644
--- a/docs/toolhive/reference/cli/thv_llm_token.md
+++ b/docs/toolhive/reference/cli/thv_llm_token.md
@@ -17,7 +17,10 @@ Print a fresh LLM gateway access token to stdout
 
 Print a fresh OIDC access token to stdout (all other output on stderr).
 Intended for use as apiKeyHelper or auth.command in OIDC-capable AI tools.
-Runs non-interactively — will not launch a browser flow.
+
+A cached or refreshable token is printed without prompting. If none exists
+(for example after "thv llm setup --lazy"), the OIDC browser login flow is
+launched automatically and the resulting token is printed once login completes.
 
 ```
 thv llm token [flags]