diff --git a/CHANGELOG.md b/CHANGELOG.md
index 216260e..36312c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,13 @@ Pre-1.0 versions treat MINOR as feature releases and PATCH as bug fixes.
 
 ---
 
+## [0.6.5] — 2026-04-12
+
+### Bug Fixes
+- **`install.sh` regenerates secrets on re-run** — `JWT_SECRET`, `JWT_REFRESH_SECRET`, and `MARIADB_ROOT_PASS` were always generated fresh, so re-running the installer after a failed build overwrote `.env` with secrets that no longer matched the already-configured MariaDB password. The installer now reads existing values from `.env` (if present) and only generates new secrets when none exist.
+
+---
+
 ## [0.6.4] — 2026-04-12
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index 835f35d..d68b49b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nixpanel-server",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "private": true,
   "workspaces": [
     "server",
diff --git a/scripts/install.sh b/scripts/install.sh
index c7255b3..c4193a0 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -82,11 +82,21 @@ if [[ -z "$ADMIN_EMAIL" ]]; then
   ADMIN_EMAIL="admin@$(hostname -f 2>/dev/null || echo localhost)"
 fi
 
-# Redirect all interactive reads to /dev/tty so curl | bash works correctly
+# ── Preserve secrets across re-runs ──────────────────────────────────────────
+# If .env already exists, reuse the same secrets so a failed-and-retried
+# install doesn't leave MariaDB with a password that doesn't match .env.
+_EXISTING_ENV="${INSTALL_DIR}/server/.env"
+if [[ -f "$_EXISTING_ENV" ]]; then
+  _read_env() { grep -m1 "^$1=" "$_EXISTING_ENV" 2>/dev/null | cut -d= -f2- | tr -d '"'; }
+  MARIADB_ROOT_PASS=$(_read_env MARIADB_PASSWORD)
+  JWT_SECRET=$(_read_env JWT_SECRET)
+  JWT_REFRESH_SECRET=$(_read_env JWT_REFRESH_SECRET)
+fi
 
-MARIADB_ROOT_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
-JWT_SECRET=$(gen_secret)
-JWT_REFRESH_SECRET=$(gen_secret)
+# Fill in any values that weren't in the existing .env (or first install)
+MARIADB_ROOT_PASS=${MARIADB_ROOT_PASS:-$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)}
+JWT_SECRET=${JWT_SECRET:-$(gen_secret)}
+JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET:-$(gen_secret)}
 
 # ── Confirm ───────────────────────────────────────────────────────────────────
 echo -e "${BOLD}Installation summary:${RESET}"
diff --git a/server/src/app.ts b/server/src/app.ts
index 2d3f55c..9c430ad 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -73,7 +73,7 @@ export async function buildApp() {
 
   fastify.get('/api/health', async () => ({
     status: 'ok',
-    version: '0.6.4',
+    version: '0.6.5',
     timestamp: new Date().toISOString(),
   }))