--- a/mrjunejune/deploy.sh	Fri Aug 07 13:02:41 2026 -0700
+++ b/mrjunejune/deploy.sh	Fri Aug 07 13:08:10 2026 -0700
@@ -6,6 +6,23 @@
 bundle="$(realpath bazel-bin/mrjunejune/mrjunejune_server_bundle)"
 staging="/opt/mrjunejune_server_bundle_new"
 active="/opt/mrjunejune_server_bundle_active"
+source_config="$(pwd)/mrjunejune/.config"
+production_config="/etc/mrjunejune/.config"
+
+# The real config is ignored and intentionally excluded from the immutable
+# bundle. Install it once into the service-owned system location; preserve the
+# existing production config on subsequent deployments.
+if ! sudo test -f "$production_config"; then
+  if [[ ! -f "$source_config" ]]; then
+    echo "Missing initial config: $source_config" >&2
+    exit 1
+  fi
+  sudo install -d -o mrjunejune_server -g zenbu_team -m 0750 \
+    "$(dirname "$production_config")"
+  sudo install -o mrjunejune_server -g zenbu_team -m 0640 \
+    "$source_config" "$production_config"
+  echo "Installed initial production config at $production_config"
+fi
 
 # Always create staging from an empty directory. Copying into an existing
 # directory nests the bundle and can promote stale/incomplete runtime files.