diff --git a/scripts/lib/deployment/dotenv.sh b/scripts/lib/deployment/dotenv.sh
index 9f1ab2d..54db294 100644
--- a/scripts/lib/deployment/dotenv.sh
+++ b/scripts/lib/deployment/dotenv.sh
@@ -24,17 +24,29 @@ load_deployment_env() {
   local dotenv="${root}/.env"
   [[ -n "${ENV_FILE:-}" && -f "${ENV_FILE}" ]] && dotenv="${ENV_FILE}"
   if [[ -f "$dotenv" ]]; then
+    local had_nounset=0
+    if [[ $- == *u* ]]; then
+      had_nounset=1
+      set +u
+    fi
     set -a
     # shellcheck disable=SC1090
     source "$dotenv"
     set +a
+    (( had_nounset )) && set -u
   fi
   local secure_secrets_file="${SECURE_SECRETS_FILE:-$HOME/.secure-secrets/private-keys.env}"
   if [[ -f "$secure_secrets_file" ]]; then
+    local had_nounset_secure=0
+    if [[ $- == *u* ]]; then
+      had_nounset_secure=1
+      set +u
+    fi
     set -a
     # shellcheck disable=SC1090
     source "$secure_secrets_file"
     set +a
+    (( had_nounset_secure )) && set -u
   fi
   if [[ -z "${PRIVATE_KEY:-}" && -n "${DEPLOYER_PRIVATE_KEY:-}" ]]; then
     export PRIVATE_KEY="$DEPLOYER_PRIVATE_KEY"