In T198810#4398207, @Krenair wrote:

We discussed this in #wikimedia-releng and realised that we'll need to sort out the bots, wmfgerrit and wmfphab. wmfgerrit uses SSH for actual automated actions so should be simple (someone with the password or access to the email behind it needs to go in and add MFA), wmfphab apparently uses HTTPS pushing so will need to switch to an access token I think.

We need to enable 2FA (and save the seed possibly in the releng password store too with the account password?), and possibly switch the config in Phab to use an access token instead