diff --git a/phoenix-deploy-api/scripts/install-systemd.sh b/phoenix-deploy-api/scripts/install-systemd.sh
index adf2c436..42aa8a78 100644
--- a/phoenix-deploy-api/scripts/install-systemd.sh
+++ b/phoenix-deploy-api/scripts/install-systemd.sh
@@ -33,6 +33,63 @@ elif [[ -f "$APP_DIR/.env" ]]; then
 elif [[ -f "$APP_DIR/.env.example" ]]; then
   cp "$APP_DIR/.env.example" "$TARGET/.env"
 fi
+
+ensure_env_value() {
+  local key="$1"
+  local value="$2"
+  local file="$TARGET/.env"
+  [[ -n "$value" && -f "$file" ]] || return 0
+
+  local current=""
+  if grep -qE "^${key}=" "$file"; then
+    current="$(grep -E "^${key}=" "$file" | tail -n 1 | cut -d= -f2-)"
+  fi
+  [[ -z "$current" ]] || return 0
+
+  local tmp
+  tmp="$(mktemp)"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { found = 0 }
+    $0 ~ "^" key "=" {
+      print key "=" value
+      found = 1
+      next
+    }
+    { print }
+    END {
+      if (!found) print key "=" value
+    }
+  ' "$file" > "$tmp"
+  cat "$tmp" > "$file"
+  rm -f "$tmp"
+}
+
+repo_env_value() {
+  local key="$1"
+  local file="$REPO_ROOT/.env"
+  [[ -f "$file" ]] || return 0
+  grep -E "^${key}=" "$file" | tail -n 1 | cut -d= -f2-
+}
+
+if [[ -f "$TARGET/.env" ]]; then
+  ensure_env_value PHOENIX_REPO_ROOT "$REPO_ROOT"
+  for key in \
+    GITEA_TOKEN \
+    PHOENIX_DEPLOY_SECRET \
+    PROXMOX_HOST \
+    PROXMOX_PORT \
+    PROXMOX_USER \
+    PROXMOX_TOKEN_NAME \
+    PROXMOX_TOKEN_VALUE \
+    PROXMOX_TLS_VERIFY \
+    PUBLIC_IP \
+    CLOUDFLARE_API_TOKEN \
+    CLOUDFLARE_GITEA_SYNC_ZONE \
+    PHOENIX_CLOUDFLARE_SYNC
+  do
+    ensure_env_value "$key" "$(repo_env_value "$key")"
+  done
+fi
 chown -R root:root "$TARGET"
 cd "$TARGET" && npm install --omit=dev
 cp "$APP_DIR/phoenix-deploy-api.service" /etc/systemd/system/