diff --git a/deploy/update.sh b/deploy/update.sh
index 2c3fd02..41fdf88 100644
--- a/deploy/update.sh
+++ b/deploy/update.sh
@@ -66,12 +66,29 @@ if [ $FORCE -eq 0 ]; then
   fi
 fi
 
+# 1.5 Pre-capture legacy ownership before remove.sh deletes the manifest (M-4)
+MAM_LEGACY_ENV_OWNED=0
+if [ -f ".mam/install_manifest.txt" ] && grep -Fqx ".env" ".mam/install_manifest.txt" 2>/dev/null; then
+  MAM_LEGACY_ENV_OWNED=1
+fi
+export MAM_LEGACY_ENV_OWNED
+
 # 2. Stage backups of user configurations and metadata to prevent deletion
 echo "💾 Backing up configuration and database..."
 HAS_ENV=0
-if [ -f ".env" ]; then
+ENV_BACKUP_SRC=""
+ENV_BACKUP_TMP=""
+
+if [ -f ".mam.env" ]; then
   HAS_ENV=1
-  mv ".env" ".env.update-tmp"
+  ENV_BACKUP_SRC=".mam.env"
+  ENV_BACKUP_TMP=".mam.env.update-tmp"
+  mv ".mam.env" "$ENV_BACKUP_TMP"
+elif [ -f ".env" ]; then
+  HAS_ENV=1
+  ENV_BACKUP_SRC=".env"
+  ENV_BACKUP_TMP=".env.update-tmp"
+  mv ".env" "$ENV_BACKUP_TMP"
 fi
 
 HAS_MAM=0
@@ -105,8 +122,8 @@ fi
 # Define trap to restore backup files on failure
 restore_on_failure() {
   echo "❌ Update failed. Reverting configuration and database to previous state..."
-  if [ $HAS_ENV -eq 1 ] && [ -f ".env.update-tmp" ]; then
-    mv -f ".env.update-tmp" ".env" 2>/dev/null || true
+  if [ $HAS_ENV -eq 1 ] && [ -n "$ENV_BACKUP_TMP" ] && [ -f "$ENV_BACKUP_TMP" ]; then
+    mv -f "$ENV_BACKUP_TMP" "$ENV_BACKUP_SRC" 2>/dev/null || true
   fi
   if [ $HAS_MAM -eq 1 ] && [ -d ".mam.update-tmp" ]; then
     # Revert to old database/jobs backup by restoring .mam directory
@@ -151,9 +168,13 @@ trap - EXIT
 
 # 5. Restore backups of configuration and database
 echo "🔄 Restoring configuration and database..."
-if [ $HAS_ENV -eq 1 ]; then
-  # Overwrite the default .env created by installer (if any) with the user's backup
-  mv -f ".env.update-tmp" ".env"
+if [ $HAS_ENV -eq 1 ] && [ -n "$ENV_BACKUP_TMP" ] && [ -f "$ENV_BACKUP_TMP" ]; then
+  if [ "$MAM_LEGACY_ENV_OWNED" = "1" ] && [ "$ENV_BACKUP_SRC" = ".env" ] && [ ! -f ".mam.env" ]; then
+    mv -f "$ENV_BACKUP_TMP" ".mam.env"
+    chmod 0600 ".mam.env" 2>/dev/null || true
+  else
+    mv -f "$ENV_BACKUP_TMP" "$ENV_BACKUP_SRC"
+  fi
 fi
 
 if [ $HAS_MAM -eq 1 ]; then