diff --git a/deploy-invttrdg.sh b/deploy-invttrdg.sh
index 4ec78b4..73b7cd7 100755
--- a/deploy-invttrdg.sh
+++ b/deploy-invttrdg.sh
@@ -232,16 +232,17 @@ else
 fi
 
 # Resolve Gitea npm token for BuildKit secret
-if [ -z "${GITEA_NPM_TOKEN:-}" ]; then
-  if [ -f "/opt/bytelyst/.gitea_token" ]; then
-    GITEA_NPM_TOKEN=$(cat /opt/bytelyst/.gitea_token)
-    export GITEA_NPM_TOKEN
-  elif [ -f "$HOME/.gitea_npm_token" ]; then
-    GITEA_NPM_TOKEN=$(cat "$HOME/.gitea_npm_token")
-    export GITEA_NPM_TOKEN
-  else
-    fail "GITEA_NPM_TOKEN not set and no token file found"
-  fi
+# Unset any existing environment variable to ensure we use file values
+unset GITEA_NPM_TOKEN
+
+if [ -f "/opt/bytelyst/.gitea_token" ]; then
+  GITEA_NPM_TOKEN=$(cat /opt/bytelyst/.gitea_token)
+  export GITEA_NPM_TOKEN
+elif [ -f "$HOME/.gitea_npm_token" ]; then
+  GITEA_NPM_TOKEN=$(cat "$HOME/.gitea_npm_token")
+  export GITEA_NPM_TOKEN
+else
+  fail "GITEA_NPM_TOKEN not set and no token file found"
 fi
 
 # Collect build metadata (consumed by @bytelyst/devops)