diff --git a/install-stack.sh b/install-stack.sh
index 92aa9aa..506ea10 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -213,7 +213,22 @@ Proceed?" 24 58 || exit 0
 }
 
 # ── Generate secrets ──────────────────────────────────────────────────────────
+CREDS_FILE=/root/hotel-manage-credentials.txt
 gen_secrets() {
+  # Resume-safe: if secrets already exist, reuse them so a re-run doesn't
+  # mismatch an already-initialised Postgres / already-deployed services.
+  if [[ -f "$CREDS_FILE" ]] && grep -q '^PG_SUPERPASS=' "$CREDS_FILE"; then
+    msg_info "Reusing existing secrets from $CREDS_FILE"
+    PG_SUPERPASS=$(sed -n 's/^PG_SUPERPASS=//p' "$CREDS_FILE" | head -1)
+    AUTH_DB_PASS=$(sed -n 's/^AUTH_DB_PASS=//p' "$CREDS_FILE" | head -1)
+    NOTICES_DB_PASS=$(sed -n 's/^NOTICES_DB_PASS=//p' "$CREDS_FILE" | head -1)
+    CENTRAL_AUTH_SECRET=$(sed -n 's/^CENTRAL_AUTH_SECRET=//p' "$CREDS_FILE" | head -1)
+    WEBHOOK_SECRET=$(sed -n 's/^WEBHOOK_SECRET=//p' "$CREDS_FILE" | head -1)
+    NPM_ADMIN_PASS=$(sed -n 's/^NPM_ADMIN_PASS=//p' "$CREDS_FILE" | head -1)
+    msg_ok "Reusing existing secrets"
+    return
+  fi
+
   msg_info "Generating secrets"
   PG_SUPERPASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
   AUTH_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
@@ -222,7 +237,7 @@ gen_secrets() {
   WEBHOOK_SECRET=$(openssl rand -hex 24)
   NPM_ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | head -c 12)
 
-  cat > /root/hotel-manage-credentials.txt <<EOF
+  cat > "$CREDS_FILE" <<EOF
 # Hotel Manage credentials — generated $(date '+%Y-%m-%d %H:%M')
 # !! KEEP THIS FILE SAFE — store a copy offsite !!
 
@@ -246,8 +261,8 @@ FORGEJO_TOKEN=${FORGEJO_TOKEN}
 
 BACKUP_REMOTE=${BACKUP_REMOTE}
 EOF
-  chmod 600 /root/hotel-manage-credentials.txt
-  msg_ok "Secrets generated → /root/hotel-manage-credentials.txt"
+  chmod 600 "$CREDS_FILE"
+  msg_ok "Secrets generated → $CREDS_FILE"
 }
 
 # ── SSH keypair for management → app LXCs ────────────────────────────────────
@@ -261,7 +276,8 @@ gen_mgmt_ssh_key() {
     msg_ok "Using existing SSH keypair at /root/.ssh/hotel-manage_deploy"
   fi
   MGMT_PUBKEY=$(cat /root/.ssh/hotel-manage_deploy.pub)
-  echo "${MGMT_PUBKEY}" >> /root/hotel-manage-credentials.txt
+  # record the pubkey once (don't duplicate on re-run)
+  grep -qF "${MGMT_PUBKEY}" "$CREDS_FILE" 2>/dev/null || echo "${MGMT_PUBKEY}" >> "$CREDS_FILE"
 }
 
 # ── LXC lifecycle helpers ─────────────────────────────────────────────────────