diff --git a/.forgejo/workflows/infra-sync.yml b/.forgejo/workflows/infra-sync.yml
index 8f86697..67cd055 100644
--- a/.forgejo/workflows/infra-sync.yml
+++ b/.forgejo/workflows/infra-sync.yml
@@ -61,6 +61,30 @@ jobs:
             cd /opt/thermograph-dev
             git fetch --prune origin dev
             git reset --hard origin/dev
+            echo "synced to $(git log --oneline -1)"
+
+            # RENDER ONLY IF THIS HOST IS ACTUALLY DEV.
+            #
+            # dev's env file is /etc/thermograph.env — the same path beta uses,
+            # and during the vps1/vps2 cutover beta is STILL ON VPS1. Rendering
+            # unconditionally would overwrite the live env file of the
+            # environment currently serving beta.thermograph.org with dev's
+            # credentials: beta's running containers would survive (env_file is
+            # read at container start) and then come up wrong on its next
+            # deploy, pointed at dev's database password.
+            #
+            # The host marker is the box's own statement of which environment it
+            # is, and it is the right authority for "is it safe to write this
+            # file here". It flips to `dev` in provision-dev.sh, which is run
+            # only after beta has vacated. Until then this skips loudly rather
+            # than failing: the checkout sync above is still useful and correct.
+            marker=$(cat /etc/thermograph/secrets-env 2>/dev/null || true)
+            if [ "$marker" != dev ]; then
+              echo "!! /etc/thermograph/secrets-env says '${marker:-<unset>}', not 'dev'."
+              echo "!! Skipping the secrets render — this host is not dev yet, and"
+              echo "!! /etc/thermograph.env here belongs to '${marker:-another environment}'."
+              exit 0
+            fi
             if [ -f infra/deploy/render-secrets.sh ]; then
               . infra/deploy/render-secrets.sh
               # SKIP_COMMON is dev's standing rule, not a preference: common.yaml
@@ -69,7 +93,6 @@ jobs:
               THERMOGRAPH_SECRETS_SKIP_COMMON=1 \
                 render_thermograph_secrets /opt/thermograph-dev/infra dev /etc/thermograph.env
             fi
-            echo "synced to $(git log --oneline -1)"
 
   sync-beta:
     if: github.ref_name == 'main'
diff --git a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
index 72934a5..b1874da 100644
--- a/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
+++ b/infra/deploy/RUNBOOK-vps1-vps2-cutover.md
@@ -278,7 +278,19 @@ sudo bash /opt/thermograph-dev/infra/deploy/provision-dev.sh   # clones if absen
 ```
 
 The script writes `/etc/thermograph/secrets-env` = `dev` and removes any
-`deploy-mode` marker. Then deploy:
+`deploy-mode` marker.
+
+**That marker flip is load-bearing, and it is why this step comes after step 9.**
+dev's env file is `/etc/thermograph.env` — the very path beta uses while beta is
+still on vps1. `infra-sync`'s `sync-dev` job refuses to render unless the marker
+already says `dev`, so until you run this script it syncs the checkout and skips
+the render with a loud message. Flip the marker before beta has vacated and the
+next dev push overwrites beta's live env file with dev's credentials; beta's
+running containers survive it and then come up wrong on their next deploy.
+
+(The checkout itself is safe to create at any time — only the render is gated.)
+
+Then deploy:
 
 ```
 cd /opt/thermograph-dev