diff --git a/infra/deploy/render-secrets.sh b/infra/deploy/render-secrets.sh
index 2db9cb4..b3b5b3c 100755
--- a/infra/deploy/render-secrets.sh
+++ b/infra/deploy/render-secrets.sh
@@ -137,9 +137,11 @@ render_thermograph_secrets() {
   # prod/beta (apt-installed Docker, no snap confinement) leave it unset and
   # this is a no-op for them.
   if [ "$rc" = 0 ] && [ -n "${THERMOGRAPH_SECRETS_ENV_FILE_MIRROR:-}" ]; then
-    mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \
-      && install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" \
-      || { echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2; rc=1; }
+    if ! mkdir -p "$(dirname "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR")" \
+       || ! install -m 0600 "$tmp" "$THERMOGRAPH_SECRETS_ENV_FILE_MIRROR"; then
+      echo "!! cannot write mirror at $THERMOGRAPH_SECRETS_ENV_FILE_MIRROR" >&2
+      rc=1
+    fi
   fi
 
   rm -f "$tmp"