diff --git a/docs/testing-progress.md b/docs/testing-progress.md
index 25e42e6..1483348 100644
--- a/docs/testing-progress.md
+++ b/docs/testing-progress.md
@@ -1387,3 +1387,4 @@ git diff --check
 - 生产 API 搜索 `1882120` 返回“中国移动/上海/上海”；搜索“上海”首屏响应约 80ms。
 - 生产 `cmpp-api`、`cmpp-gateway`、PostgreSQL、Nginx 均为 active，API health 正常。
 - 隔离部署后曾因 `dist/assets` 被保留为 `700 root:root` 导致 Nginx 无权读取 JS/CSS、admin 页面空白；线上已修正为目录 `755`、文件 `644`，正式生产部署脚本同步固化权限。
+- 正式部署发现已有生产管理员且未配置 `PROD_ADMIN_PASSWORD` 时，`upsert.create` 仍会对空密码执行哈希；已拆分 create/update 密码变量，已有账号不改密码，新建账号才生成临时密码。
diff --git a/tools/deploy/ensure-production-admin.mjs b/tools/deploy/ensure-production-admin.mjs
index 8eb19ad..916e91b 100644
--- a/tools/deploy/ensure-production-admin.mjs
+++ b/tools/deploy/ensure-production-admin.mjs
@@ -20,7 +20,8 @@ function hashPassword(value) {
 
 async function main() {
   const existingUser = await prisma.user.findUnique({ where: { username } });
-  const password = configuredPassword || (existingUser ? undefined : randomBytes(18).toString('base64url'));
+  const createPassword = configuredPassword || randomBytes(18).toString('base64url');
+  const updatePassword = configuredPassword;
   const role = await prisma.role.upsert({
     where: { code: 'platform_admin' },
     update: { name: '平台管理员', scope: 'platform' },
@@ -31,7 +32,7 @@ async function main() {
     update: {
       email,
       displayName: '生产平台管理员',
-      ...(password ? { passwordHash: hashPassword(password) } : {}),
+      ...(updatePassword ? { passwordHash: hashPassword(updatePassword) } : {}),
       status: 'active',
       failedLoginCount: 0,
       lockedUntil: null,
@@ -42,7 +43,7 @@ async function main() {
       username,
       email,
       displayName: '生产平台管理员',
-      passwordHash: hashPassword(password),
+      passwordHash: hashPassword(createPassword),
       status: 'active',
     },
   });
@@ -56,7 +57,9 @@ async function main() {
     'CMPP production admin account',
     `username=${username}`,
     `email=${email}`,
-    password ? `password=${password}` : 'password=unchanged',
+    existingUser
+      ? (updatePassword ? `password=${updatePassword}` : 'password=unchanged')
+      : `password=${createPassword}`,
     `generatedAt=${new Date().toISOString()}`,
     '',
   ].join('\n');
@@ -65,7 +68,7 @@ async function main() {
   }
   console.log(`Production admin is ready: ${email}`);
   if (!credentialFile) {
-    console.log(`Temporary password: ${password}`);
+    console.log(existingUser && !updatePassword ? 'Password unchanged' : `Temporary password: ${existingUser ? updatePassword : createPassword}`);
   }
 }