diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index f317b78..d64edd0 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -163,8 +163,9 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   echo '  Rendering Caddyfile (basicauth hashes from .env)...'
   # Extract the hashes with grep/cut rather than sourcing .env: sourcing a
   # bcrypt value in a set -u shell dies on its dollar-sign expansion.
-  CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env | tail -1 | cut -d= -f2-)\"
-  CADDY_ADMIN_HASH=\"\$(grep -E '^CADDY_ADMIN_HASH=' .env | tail -1 | cut -d= -f2-)\"
+  # '|| true' so a missing hash warns below instead of aborting under set -e.
+  CADDY_BASICAUTH_HASH=\"\$(grep -E '^CADDY_BASICAUTH_HASH=' .env 2>/dev/null | tail -1 | cut -d= -f2- || true)\"
+  CADDY_ADMIN_HASH=\"\$(grep -E '^CADDY_ADMIN_HASH=' .env 2>/dev/null | tail -1 | cut -d= -f2- || true)\"
   if [ -n \"\${CADDY_BASICAUTH_HASH}\" ] && [ -n \"\${CADDY_ADMIN_HASH}\" ]; then
     # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy