diff --git a/git-cookie-authdaemon b/git-cookie-authdaemon
index 9e37004..27fae4b 100755
--- a/git-cookie-authdaemon
+++ b/git-cookie-authdaemon
@@ -20,10 +20,31 @@
 REFRESH = 25  # seconds remaining when starting refresh
 RETRY_INTERVAL = 5 # seconds between retrying a failed refresh
 
-A = 'http://metadata/0.1/meta-data/service-accounts/default/acquire'
-S = 'https://www.googleapis.com/auth/gerritcodereview'
+META_URL = 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/'
+SUPPORTED_SCOPES = [
+  'https://www.googleapis.com/auth/gerritcodereview',
+  'https://www.googleapis.com/auth/source.full_control',
+  'https://www.googleapis.com/auth/source.read_write',
+  'https://www.googleapis.com/auth/source.read_only',
+]
 COOKIE_JAR = None
 
+def read_meta(part):
+  r = urllib2.Request(META_URL + part)
+  r.add_header('Metadata-Flavor', 'Google')
+  return contextlib.closing(urllib2.urlopen(r))
+
+def select_scope():
+  with read_meta('scopes') as d:
+    avail = set(d.read().split())
+  scopes = [s for s in SUPPORTED_SCOPES if s in avail]
+  if scopes:
+    return iter(scopes).next()
+  sys.stderr.write('error: VM must have one of these scopes:\n\n')
+  for s in SUPPORTED_SCOPES:
+    sys.stderr.write('  %s\n' % (s))
+  sys.exit(1)
+
 def configure_git():
   global COOKIE_JAR
 
@@ -39,59 +60,43 @@
     'http.cookiefile', COOKIE_JAR
   ])
 
-def acquire_token(retry):
+def acquire_token(scope, retry):
   while True:
     try:
-      with contextlib.closing(urllib2.urlopen(A + '?scopes=' + S)) as token:
-        return json.load(token)
+      with read_meta('token?scopes=' + scope) as d:
+        return json.load(d)
     except urllib2.URLError:
       if not retry:
         raise
     time.sleep(RETRY_INTERVAL)
 
-def update_cookie(retry):
-  token = acquire_token(retry)
-  expires = token['expiresAt']
-  access_token = token['accessToken']
+def update_cookie(scope, retry):
+  now = int(time.time())
+  token = acquire_token(scope, retry)
+  access_token = token['access_token']
+  expires = now + int(token['expires_in'])
 
   tmp_jar = COOKIE_JAR + '.lock'
   cj = cookielib.MozillaCookieJar(tmp_jar)
 
-  cj.set_cookie(cookielib.Cookie(
-    version = 0,
-    name = 'o',
-    value = access_token,
-    port = None,
-    port_specified = False,
-    domain = 'source.developers.google.com',
-    domain_specified = True,
-    domain_initial_dot = False,
-    path = '/',
-    path_specified = True,
-    secure = True,
-    expires = expires,
-    discard = False,
-    comment = None,
-    comment_url = None,
-    rest = None))
-
-  cj.set_cookie(cookielib.Cookie(
-    version = 0,
-    name = 'o',
-    value = access_token,
-    port = None,
-    port_specified = False,
-    domain = '.googlesource.com',
-    domain_specified = True,
-    domain_initial_dot = True,
-    path = '/',
-    path_specified = True,
-    secure = True,
-    expires = expires,
-    discard = False,
-    comment = None,
-    comment_url = None,
-    rest = None))
+  for d in ['source.developers.google.com', '.googlesource.com']:
+    cj.set_cookie(cookielib.Cookie(
+      version = 0,
+      name = 'o',
+      value = access_token,
+      port = None,
+      port_specified = False,
+      domain = d,
+      domain_specified = True,
+      domain_initial_dot = d.startswith('.'),
+      path = '/',
+      path_specified = True,
+      secure = True,
+      expires = expires,
+      discard = False,
+      comment = None,
+      comment_url = None,
+      rest = None))
 
   cj.save()
   os.rename(tmp_jar, COOKIE_JAR)
@@ -103,7 +108,7 @@
       if os.path.exists(p):
         os.remove(p)
 
-def refresh_loop(expires):
+def refresh_loop(scope, expires):
   atexit.register(cleanup)
   expires = expires - REFRESH
   while True:
@@ -112,11 +117,12 @@
     while now < expires:
       time.sleep(expires - now)
       now = time.time()
-    expires = update_cookie(retry=True) - REFRESH
+    expires = update_cookie(scope, retry=True) - REFRESH
 
 def main():
+  scope = select_scope()
   configure_git()
-  expires = update_cookie(retry=False)
+  expires = update_cookie(scope, retry=False)
 
   if '--nofork' not in sys.argv:
     if os.fork() > 0:
@@ -128,10 +134,10 @@
 
     pid = os.fork()
     if pid > 0:
-      print '%s PID %d' % (sys.argv[0], pid)
+      print 'git-cookie-authdaemon PID %d' % (pid)
       sys.exit(0)
 
-  refresh_loop(expires)
+  refresh_loop(scope, expires)
 
 if __name__ == '__main__':
   main()