diff --git a/tools/deploy/ensure-production-admin.mjs b/tools/deploy/ensure-production-admin.mjs
index 29dab90..8eb19ad 100644
--- a/tools/deploy/ensure-production-admin.mjs
+++ b/tools/deploy/ensure-production-admin.mjs
@@ -11,7 +11,7 @@ if (!databaseUrl) {
 const prisma = new PrismaClient({ adapter: new PrismaPg(databaseUrl) });
 const username = process.env.PROD_ADMIN_USERNAME || 'prod_admin';
 const email = process.env.PROD_ADMIN_EMAIL || 'admin@example.com';
-const password = process.env.PROD_ADMIN_PASSWORD || randomBytes(18).toString('base64url');
+const configuredPassword = process.env.PROD_ADMIN_PASSWORD;
 const credentialFile = process.env.PROD_ADMIN_CREDENTIAL_FILE;
 
 function hashPassword(value) {
@@ -19,6 +19,8 @@ function hashPassword(value) {
 }
 
 async function main() {
+  const existingUser = await prisma.user.findUnique({ where: { username } });
+  const password = configuredPassword || (existingUser ? undefined : randomBytes(18).toString('base64url'));
   const role = await prisma.role.upsert({
     where: { code: 'platform_admin' },
     update: { name: '平台管理员', scope: 'platform' },
@@ -29,7 +31,7 @@ async function main() {
     update: {
       email,
       displayName: '生产平台管理员',
-      passwordHash: hashPassword(password),
+      ...(password ? { passwordHash: hashPassword(password) } : {}),
       status: 'active',
       failedLoginCount: 0,
       lockedUntil: null,
@@ -54,7 +56,7 @@ async function main() {
     'CMPP production admin account',
     `username=${username}`,
     `email=${email}`,
-    `password=${password}`,
+    password ? `password=${password}` : 'password=unchanged',
     `generatedAt=${new Date().toISOString()}`,
     '',
   ].join('\n');