diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index dc7bb18..1dca9d8 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,14 +1,29 @@
 #!/usr/bin/env bash
-# Pulls a project's env from keep, then brings its docker compose stack up.
+# Pulls a project's env from keep (if it's bootstrapped onto keep), then
+# brings its docker compose stack up.
 #
 # Usage:
 #   ./deploy.sh <project> [env]
 #
-# Expects, per project, a directory at $DEPLOY_ROOT/<project>/ containing
-# a docker-compose.yml. Vault key pulled is "<project>/<env>" (env
-# defaults to "production"). Requires a keep identity already registered
-# and granted read access to that vault on this machine
-# (see INTEGRATION.md).
+# Expects a directory at $DEPLOY_ROOT/<project>/ containing a
+# docker-compose.yml.
+#
+# The vault key is NOT assumed to match the deploy-directory name — repo
+# names, deploy directory names, and vault keys are three independent
+# strings in practice (a repo can be named one thing, its deploy
+# directory another, entirely by history/accident). Resolution:
+#   1. $dir/.keep-vault, if present — a one-time-per-project marker
+#      (`echo "<vault key>" > "$dir/.keep-vault"` when bootstrapping),
+#      one line, human-readable, cat-able to check what's configured.
+#   2. Otherwise falls back to "<project>/<env>" — works when the vault
+#      key genuinely does match, and is also the graceful "not
+#      bootstrapped yet" case for a keep pull that's expected to fail.
+#
+# `keep pull` is always best-effort: a missing vault, a missing grant, or
+# `keep` not being installed at all is never fatal here — it means "keep
+# doesn't apply to this project (yet)," never "stop the deploy." Whatever
+# .env already exists on disk (hand-copied, or from a previous keep pull)
+# is what docker compose reads either way.
 set -euo pipefail
 
 project="${1:?usage: deploy.sh <project> [env]}"
@@ -21,5 +36,18 @@ if [ ! -d "$dir" ]; then
   exit 1
 fi
 
-keep pull "$project/$env" --out "$dir/.env"
+if [ -f "$dir/.keep-vault" ]; then
+  vault="$(cat "$dir/.keep-vault")"
+else
+  vault="$project/$env"
+fi
+
+if command -v keep >/dev/null 2>&1 && keep pull "$vault" --out "$dir/.env.new" 2>/dev/null; then
+  mv "$dir/.env.new" "$dir/.env"
+  echo "  ✓ pulled $vault"
+else
+  rm -f "$dir/.env.new"
+  echo "  · keep pull skipped or failed for $vault (using existing .env, if any)"
+fi
+
 (cd "$dir" && docker compose up -d)