After vaccinating health care workers and vulnerable groups against COVID-19, authorities will need to decide how to vaccinate everyone else. Prioritising individuals with more contacts can be disproportionately effective, in theory, but identifying these individuals is difficult. Here we show that the technology underlying Bluetooth exposure notification applications, such as used for digital contact tracing, can be leveraged to prioritise vaccination based on individual contact data. Our approach is based on the insight that these apps also act as local sensing devices measuring each user's total exposure time to other users, thereby enabling the implementation of a previously impossible strategy that prioritises potential super-spreaders. Furthermore, by generalising percolation theory and introducing a novel measure of vaccination efficiency, we demonstrate that this ``hot-spotting" strategy can achieve herd immunity with up to half as many vaccines as a non-targeted strategy, and is attractive even for relatively low rates of app usage.