diff --git a/install-stack.sh b/install-stack.sh
index 9bbdcf1..ffe0ae7 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -909,6 +909,28 @@ deploy_settings() {
   install_mgmt_key 116
   msg_ok "Docker + SSH ready"
 
+  # Re-assert the settings DB role/password on every deploy, not just first
+  # install — the role was originally only created once, in deploy_postgres()'s
+  # init SQL (fresh-volume-only), so a redeploy had no way to self-heal if
+  # CREDS_FILE's SETTINGS_DB_PASS ever drifted from the role's actual password
+  # (hit in production 2026-08-13: settings crash-looped on "password
+  # authentication failed" after a routine redeploy). CREATE first (covers a
+  # brand-new postgres where the role doesn't exist yet), ALTER as fallback
+  # (covers drift on an already-existing role) — CREATE-with-swallowed-error
+  # alone, as other apps' deploy functions use, can't fix drift.
+  msg_info "Syncing settings database credentials"
+  pct exec 100 -- bash -c "
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE USER settings WITH PASSWORD '${SETTINGS_DB_PASS}';\" 2>/dev/null || \
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"ALTER USER settings WITH PASSWORD '${SETTINGS_DB_PASS}';\"
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE DATABASE settings_db OWNER settings;\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -d settings_db -c \
+      \"GRANT ALL ON SCHEMA public TO settings;\" 2>/dev/null || true
+  " &>/dev/null
+  msg_ok "Database settings_db ready"
+
   # Copy the shared deploy SSH key so settings can SSH into the MQTT broker
   # LXC (104) to manage dynamic-security clients — same mechanism management
   # uses for its Shell/exec tab, just consumed by a second container.