diff --git a/scripts/update.sh b/scripts/update.sh
index f18324a..d4f063f 100644
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -13,13 +13,19 @@ cd "$(dirname "$0")/.."
 
 [ -f .env ] || cp .env.example .env
 
+# Handles all three cases: the KEY=value line is missing entirely (.env
+# predates that var being added to .env.example — sed can't fix what isn't
+# there, so this appends it), present but blank, or already set.
 set_if_blank() {
   local key="$1" value="$2"
   if grep -qE "^${key}=.*[^[:space:]]" .env; then
     echo "${key}: already set, skipping."
-  else
+  elif grep -qE "^${key}=" .env; then
     sed -i "s|^${key}=.*|${key}=${value}|" .env
     echo "${key}: set."
+  else
+    echo "${key}=${value}" >> .env
+    echo "${key}: added (was missing from .env)."
   fi
 }
 
@@ -77,7 +83,12 @@ mint_key_if_blank() {
     -H "Content-Type: application/json" \
     -d "{\"key_alias\": \"${alias}\"}" | jq -r '.key')
   if [ -n "$minted" ] && [ "$minted" != "null" ]; then
-    sed -i "s|^${key}=.*|${key}=${minted}|" .env
+    # Same missing-line-vs-blank-line handling as set_if_blank above.
+    if grep -qE "^${key}=" .env; then
+      sed -i "s|^${key}=.*|${key}=${minted}|" .env
+    else
+      echo "${key}=${minted}" >> .env
+    fi
     echo "${key}: minted."
   else
     echo "${key}: mint failed, create it by hand per docs/proxy-key-onboarding.md."