diff --git a/scripts/seed-secrets.sh b/scripts/seed-secrets.sh
index 74529df..57ef15d 100755
--- a/scripts/seed-secrets.sh
+++ b/scripts/seed-secrets.sh
@@ -1,12 +1,8 @@
 #!/bin/sh
-# One-shot: populate Infisical with oikos secrets.
-# Extracts secret values from running containers (where docker-compose
-# injects them from the host .env) and pushes them into Infisical via
-# the api container's oikos binary.
+# One-shot: populate Infisical with oikos secrets from container env.
+# Only runs if Infisical is empty (first bootstrap). Safe to re-run.
 #
 # Usage: ./scripts/seed-secrets.sh
-#
-# Safe to re-run (set is idempotent).
 
 set -e
 
@@ -16,6 +12,16 @@ COMPOSE="docker compose -f $REPO_DIR/docker-compose.yml"
 
 echo "=== seed-secrets: $(date) ==="
 
+# Skip if Infisical already has secrets (avoid overwriting real values
+# with dev defaults from docker-compose).
+existing=$($COMPOSE exec -T api /oikos secret list 2>/dev/null | grep -c . || echo 0)
+if [ "$existing" -gt 3 ]; then
+    echo "SKIP: Infisical already has $existing secrets (bootstrap complete)"
+    exit 0
+fi
+
+echo "Infisical has $existing secrets — seeding..."
+
 set_count=0
 skip_count=0
 fail_count=0