diff --git a/.gitea/workflows/demo-bootstrap.yml b/.gitea/workflows/demo-bootstrap.yml
index b72552f..bb6a8b6 100644
--- a/.gitea/workflows/demo-bootstrap.yml
+++ b/.gitea/workflows/demo-bootstrap.yml
@@ -52,10 +52,6 @@ jobs:
             sudo -n mkdir -p "$DEMO_DIR"
             sudo -n chown "$(id -u):$(id -g)" "$DEMO_DIR"
           fi
-          if test -f "$DEMO_DIR/.env"; then
-            echo "$DEMO_DIR/.env already exists; left untouched."
-            exit 0
-          fi
           echo "PTERODACTYL_CLIENT_KEY secret present: $(test -n "$PTERODACTYL_CLIENT_KEY" && echo yes || echo no)"
 
           # The rig's web token: the startup variable first, then sidecar.toml.
@@ -71,10 +67,25 @@ jobs:
           fi
 
           hex() { head -c "$1" /dev/urandom | od -An -tx1 | tr -d ' \n'; }
+          setkv() { K="$1" V="$2" awk 'index($0, ENVIRON["K"] "=") == 1 { $0 = ENVIRON["K"] "=" ENVIRON["V"] } { print }' "$f" > "$f.tmp"; cat "$f.tmp" > "$f"; rm -f "$f.tmp"; }
+
+          # An existing .env keeps every value; only an empty rig token is filled.
+          if test -f "$DEMO_DIR/.env"; then
+            f="$DEMO_DIR/.env"
+            if grep -q '^DEMO_RIG_SIDECAR_TOKEN=$' "$f" && test -n "$RIG_TOKEN"; then
+              setkv DEMO_RIG_SIDECAR_TOKEN "$RIG_TOKEN"
+              echo "$f exists; filled DEMO_RIG_SIDECAR_TOKEN only."
+            else
+              echo "$f exists; left untouched."
+            fi
+            echo "Empty keys left:"
+            grep -E '^[A-Z_]+=$' "$f" | cut -d= -f1 || true
+            exit 0
+          fi
+
           f="$DEMO_DIR/.env.new"
           cp deploy/demo/.env.example "$f"
           chmod 600 "$f"
-          setkv() { K="$1" V="$2" awk 'index($0, ENVIRON["K"] "=") == 1 { $0 = ENVIRON["K"] "=" ENVIRON["V"] } { print }' "$f" > "$f.tmp"; mv "$f.tmp" "$f"; }
           setkv DB_PASSWORD "$(hex 24)"
           setkv DB_ROOT_PASSWORD "$(hex 24)"
           setkv JWT_SECRET "$(hex 32)"