diff --git a/.changelog/14495.txt b/.changelog/14495.txt
new file mode 100644
index 000000000..e002bbbdc
--- /dev/null
+++ b/.changelog/14495.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Detect a TokenSecretID cookie and passthrough to localStorage
+```
diff --git a/ui/packages/consul-ui/app/routes/application.js b/ui/packages/consul-ui/app/routes/application.js
index 89eb67c53..53c2312c6 100644
--- a/ui/packages/consul-ui/app/routes/application.js
+++ b/ui/packages/consul-ui/app/routes/application.js
@@ -1,14 +1,44 @@
 import Route from 'consul-ui/routing/route';
 import { action } from '@ember/object';
 import { inject as service } from '@ember/service';
+import { runInDebug } from '@ember/debug';
 
 import WithBlockingActions from 'consul-ui/mixins/with-blocking-actions';
 
 export default class ApplicationRoute extends Route.extend(WithBlockingActions) {
   @service('client/http') client;
+  @service('env') env;
+  @service('repository/token') tokenRepo;
+  @service('settings') settings;
 
   data;
 
+  async model() {
+    if(this.env.var('CONSUL_ACLS_ENABLED')) {
+      const secret = this.env.var('CONSUL_HTTP_TOKEN');
+      const existing = await this.settings.findBySlug('token');
+      if(!existing.AccessorID && secret) {
+        try {
+          const token = await this.tokenRepo.self({
+            secret: secret,
+            dc: this.env.var('CONSUL_DATACENTER_LOCAL')
+          });
+          await this.settings.persist({
+            token: {
+              AccessorID: token.AccessorID,
+              SecretID: token.SecretID,
+              Namespace: token.Namespace,
+              Partition: token.Partition,
+            }
+          });
+        } catch(e) {
+          runInDebug(_ => console.error(e));
+        }
+      }
+    }
+    return {};
+  }
+
   @action
   onClientChanged(e) {
     let data = e.data;
diff --git a/ui/packages/consul-ui/app/utils/get-environment.js b/ui/packages/consul-ui/app/utils/get-environment.js
index 4a42660c0..0e363eed9 100644
--- a/ui/packages/consul-ui/app/utils/get-environment.js
+++ b/ui/packages/consul-ui/app/utils/get-environment.js
@@ -192,7 +192,7 @@ export default function(config = {}, win = window, doc = document) {
     }
   };
   const ui = function(key) {
-    let $;
+    let $ = {};
     switch (config.environment) {
       case 'development':
       case 'staging':
@@ -227,15 +227,28 @@ export default function(config = {}, win = window, doc = document) {
             case 'CONSUL_UI_CONFIG':
               prev['CONSUL_UI_CONFIG'] = JSON.parse(value);
               break;
+            case 'TokenSecretID':
+              prev['CONSUL_HTTP_TOKEN'] = value;
+              break;
             default:
               prev[key] = value;
           }
           return prev;
         }, {});
-        if (typeof $[key] !== 'undefined') {
-          return $[key];
-        }
         break;
+      case 'production':
+        $ = dev().reduce(function(prev, [key, value]) {
+          switch (key) {
+            case 'TokenSecretID':
+              prev['CONSUL_HTTP_TOKEN'] = value;
+              break;
+          }
+          return prev;
+        }, {});
+        break;
+    }
+    if (typeof $[key] !== 'undefined') {
+      return $[key];
     }
     return config[key];
   };