diff --git a/deploy.sh b/deploy.sh
index c9572c3..17b2aae 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -141,7 +141,9 @@ if [ "$GREENFIELD" = true ]; then
     # Extract Authelia secret for binary
     AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
     if [ -n "$AUTHELIA_SECRET" ]; then
-        echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
+        if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
+            echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
+        fi
     fi
 
     # Write systemd service
@@ -173,6 +175,16 @@ else
     systemctl stop $SERVICE_NAME 2>/dev/null || true
     echo "[4/5] Swapping binary..."
     cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
+
+    # Ensure AUTHELIA_SECRET is in .env
+    AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
+    if [ -n "$AUTHELIA_SECRET" ]; then
+        if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
+            echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
+            echo "[INFO] AUTHELIA_SECRET added to .env"
+        fi
+    fi
+
     echo "[5/5] Restarting services..."
     podman restart caddy authelia 2>/dev/null || true
     systemctl restart $SERVICE_NAME