diff --git a/.gitea/workflows/deploy-stack.yml b/.gitea/workflows/deploy-stack.yml
index d1b2fd6..b9eac75 100644
--- a/.gitea/workflows/deploy-stack.yml
+++ b/.gitea/workflows/deploy-stack.yml
@@ -164,6 +164,13 @@ jobs:
               esac
               dst_dir="$(dirname -- "$dst")"
               [ "$dst_dir" = "." ] || mkdir -p "$dst_dir"
+              # Pre-clear any leftover destination. Catches the case where
+              # a stack's first SOPS deploy lands on a host whose old
+              # hand-edited plaintext .env is still root-owned (the runner
+              # can't overwrite it, but it can unlink it because it owns
+              # the stack dir). On a non-empty repo where the runner is
+              # the legitimate writer of $dst, this is a no-op.
+              rm -f -- "$dst"
               umask 077
               sops --decrypt --output-type "$out_format" --output "$dst" "$src"
               chmod 600 "$dst"