diff --git a/deploy.sh b/deploy.sh
index 1f02876..1cda66f 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -36,14 +36,20 @@ python3 scripts/sync_nav.py
 # / ${TELEGRAM_CHAT_ID}) crash-loops it ("cannot unmarshal !!str `${TELEG...`").
 # We substitute the real values here from .env at deploy time. Only those two
 # vars are expanded so Alertmanager's own {{ }} Go-template message is untouched.
+# NB: we extract just these two keys (not `source .env`) because .env holds values
+# with shell-hostile chars (e.g. SMTP_PASS) that break `. ./.env`.
 echo ""
 echo "=== Rendering monitoring/alertmanager.yml from template ==="
 if [ -f monitoring/alertmanager.yml.template ]; then
-  set -a; [ -f .env ] && . ./.env; set +a
+  get_env() { sed -n "s/^$1=//p" .env | head -n1; }
+  TELEGRAM_BOT_TOKEN="$(get_env TELEGRAM_BOT_TOKEN)"
+  TELEGRAM_CHAT_ID="$(get_env TELEGRAM_CHAT_ID)"
+  export TELEGRAM_BOT_TOKEN TELEGRAM_CHAT_ID
   envsubst '${TELEGRAM_BOT_TOKEN} ${TELEGRAM_CHAT_ID}' \
     < monitoring/alertmanager.yml.template > monitoring/alertmanager.yml
-  if grep -q '\${TELEGRAM' monitoring/alertmanager.yml; then
-    echo "WARN: TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID not set in .env; Alertmanager will crash-loop." >&2
+  if grep -q '\${TELEGRAM' monitoring/alertmanager.yml \
+     || [ -z "$TELEGRAM_BOT_TOKEN" ] || [ -z "$TELEGRAM_CHAT_ID" ]; then
+    echo "WARN: TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID missing in .env; Alertmanager will crash-loop." >&2
   fi
 fi