diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 9cdcd9d..6fa5c25 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -124,8 +124,10 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   cp shared/alloy/config.alloy /opt/alloy/config/config.alloy
 
   echo '  Rendering Caddyfile (basicauth hash from .env)...'
-  set -a; . ./.env; set +a
-  if [ -z \"\${CADDY_BASICAUTH_HASH:-}\" ]; then
+  # Extract the hash with grep/cut rather than sourcing .env: sourcing a
+  # bcrypt value in a set -u shell dies on its dollar-sign expansion.
+  CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env | tail -1 | cut -d= -f2-)\"
+  if [ -z \"\${CADDY_BASICAUTH_HASH}\" ]; then
     echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
   else
     # '|' delimiter: the bcrypt hash contains '/' characters.