diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml
index d34a3b4..58409f4 100644
--- a/.gitea/workflows/deploy-prod.yml
+++ b/.gitea/workflows/deploy-prod.yml
@@ -19,6 +19,11 @@ jobs:
       - name: Connect Runner to Overlay Network
         run: docker network connect iklimco-net $(hostname) || true
 
+      - name: Ensure vault_unseal_key placeholder exists
+        run: |
+          docker secret ls --format '{{.Name}}' | grep -q '^vault_unseal_key' || \
+            echo "bootstrap" | docker secret create vault_unseal_key -
+
       - name: Deploy Vault Stack
         run: |
           docker stack deploy \