diff --git a/deploy/install.sh b/deploy/install.sh
index 2a72ee2..db48f38 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -55,16 +55,26 @@
 
 # ── 2. .env ────────────────────────────────────────────────────────
 say "Provisioning .env"
+NEED_PASS=0
 if [ ! -f .env ]; then
     cp deploy/env.template .env
-    DB_PASS="$(head -c 24 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 32)"
-    sed -i "s|^NAVI_DB_PASSWORD=.*|NAVI_DB_PASSWORD=${DB_PASS}|" .env
-    sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgresql://navi:${DB_PASS}@127.0.0.1:5432/navi|" .env
-    echo "Created .env with a generated DB password."
-    echo "TODO left in .env: OLLAMA_API_KEY (Ollama Cloud key)."
+    NEED_PASS=1
+    echo "Created .env from deploy/env.template."
+elif grep -q "CHANGEME" .env; then
+    # The deploy branch ships a committed .env with placeholder secrets —
+    # regenerate the DB password on first install.
+    NEED_PASS=1
+    echo ".env carries placeholders — generating real secrets."
 else
     echo ".env already exists — keeping it."
 fi
+if [ "$NEED_PASS" = "1" ]; then
+    DB_PASS="$(head -c 24 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c 32)"
+    sed -i "s|^NAVI_DB_PASSWORD=.*|NAVI_DB_PASSWORD=${DB_PASS}|" .env
+    sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgresql://navi:${DB_PASS}@127.0.0.1:5432/navi|" .env
+    echo "Generated DB password."
+fi
+grep -qE "^OLLAMA_API_KEY=.\+" .env || echo "TODO left in .env: OLLAMA_API_KEY (Ollama Cloud key)."
 
 # ── 3. PostgreSQL ───────────────────────────────────────────────────
 say "Starting dockerized PostgreSQL (pgvector)"