diff --git a/deployments/pocket-id/deploy.sh b/deployments/pocket-id/deploy.sh
index f674032..82e990b 100644
--- a/deployments/pocket-id/deploy.sh
+++ b/deployments/pocket-id/deploy.sh
@@ -40,6 +40,15 @@ set -euo pipefail
 [[ "$SKIP_PROMPTS" == "1" ]] && FORCE=1
 : "${POCKETID_DOMAIN:=}"
 : "${ACME_EMAIL:=}"
+# Whether the WebFinger keys actually arrived in this script's ENVIRONMENT has to
+# be recorded BEFORE the ":=" defaults below, which make an unset variable look
+# like an empty one. The .env is what decides whether the WebFinger block is
+# served, so a value passed to a re-run has to be written through to it.
+WF_KEYS_FROM_ENV=()
+for _k in BASE_DOMAIN REDIRECT_URL; do
+    if [[ -n "${!_k+x}" ]]; then WF_KEYS_FROM_ENV+=("$_k"); fi
+done
+
 : "${BASE_DOMAIN:=}"            # optional: enables the WebFinger block (set with REDIRECT_URL)
 : "${REDIRECT_URL:=}"          # optional: where the base domain 301s non-webfinger traffic
 
@@ -171,6 +180,17 @@ install -m 0640 "$SCRIPT_DIR/docker-compose.yml" "$STACK_DIR/docker-compose.yml"
 # can be appended when BASE_DOMAIN is set.)
 
 ENV_FILE="$STACK_DIR/.env"
+set_env() {  # <KEY> <value>: update KEY in .env, or append if absent
+    local key="$1" val="$2" esc
+    esc=${val//\/\\}; esc=${esc//|/\|}; esc=${esc//&/\&}
+    if grep -qE "^${key}=" "$ENV_FILE"; then
+        sed -i -e "s|^${key}=.*|${key}=${esc}|" "$ENV_FILE"
+    else
+        printf '%s=%s
+' "$key" "$val" >> "$ENV_FILE"
+    fi
+}
+
 if [[ ! -f "$ENV_FILE" ]]; then
     log "Seeding $ENV_FILE with generated secrets..."
     install -m 0600 "$SCRIPT_DIR/.env.example" "$ENV_FILE"
@@ -183,7 +203,18 @@ if [[ ! -f "$ENV_FILE" ]]; then
         -e "s|^REDIRECT_URL=.*|REDIRECT_URL=${REDIRECT_URL}|" \
         "$ENV_FILE"
 else
-    log ".env exists; leaving secrets alone."
+    log ".env exists; keeping it (secrets and values not passed are left alone)."
+    # The WebFinger decision below is read from .env, so a BASE_DOMAIN passed to a
+    # re-run has to land there -- otherwise enabling WebFinger is a silent no-op
+    # that still reports DEPLOYED. Only keys actually passed this run are touched:
+    # automations.sh drops a blank optional answer, so "blank" is indistinguishable
+    # from "not supplied" and must not be treated as "disable".
+    for _k in ${WF_KEYS_FROM_ENV[@]+"${WF_KEYS_FROM_ENV[@]}"}; do
+        _cur=$(sed -n "s/^${_k}=//p" "$ENV_FILE" | tail -n1)
+        if [[ "$_cur" == "${!_k}" ]]; then continue; fi
+        set_env "$_k" "${!_k}"
+        log "  ${_k}: ${_cur:-<unset>} -> ${!_k:-<empty>}"
+    done
 fi
 
 # Validate required values are present.
@@ -202,6 +233,8 @@ ru="$(sed -n 's/^REDIRECT_URL=//p' "$ENV_FILE")"
 if [[ -n "$bd" ]]; then
     [[ -n "$ru" ]] || die "BASE_DOMAIN is set but REDIRECT_URL is empty in $ENV_FILE; set both or neither."
     log "WebFinger enabled -- serving /.well-known/webfinger at ${bd}."
+    log "  (to retire it, clear BASE_DOMAIN + REDIRECT_URL in $ENV_FILE and re-run --"
+    log "   leaving the prompt blank cannot disable it, as a blank answer is dropped)"
     cat "$SCRIPT_DIR/Caddyfile.webfinger" >> "$STACK_DIR/Caddyfile"
 else
     log "No BASE_DOMAIN -- pocket-id only (use the webfinger deployment for OIDC discovery)."