diff --git a/.forgejo/workflows/deploy-forum.yml b/.forgejo/workflows/deploy-forum.yml
index edc1adb..2f18fb7 100644
--- a/.forgejo/workflows/deploy-forum.yml
+++ b/.forgejo/workflows/deploy-forum.yml
@@ -46,6 +46,14 @@ jobs:
           FORUM_DB_SHARED_BUFFERS:  ${{ secrets.FORUM_DB_SHARED_BUFFERS }}
         run: |
           set -eu
+          missing=""
+          for v in FORUM_BIND FORUM_PORT KNOWN_PROXY FORUM_ADMIN_EMAIL FORUM_SMTP_ADDRESS FORUM_SMTP_USER FORUM_SMTP_PASSWORD; do
+            [ -n "$(printenv "$v" || true)" ] || missing="$missing $v"
+          done
+          if [ -n "$missing" ]; then
+            echo "ERROR: disse secrets mangler i repo-indstillingerne:$missing (FORUM_BIND er secret HOST_BIND). Se docs/community.md."
+            exit 1
+          fi
           # Samme sti inde og ude, så launcherens bind mounts (/var/discourse/shared/...) peger på værtens mapper.
           docker run --rm \
             -v /var/run/docker.sock:/var/run/docker.sock \
diff --git a/deploy/forum/install.sh b/deploy/forum/install.sh
index f1f3b9f..2fe03b0 100755
--- a/deploy/forum/install.sh
+++ b/deploy/forum/install.sh
@@ -17,6 +17,11 @@ fi
 
 command -v docker >/dev/null || { echo "Docker mangler." >&2; exit 1; }
 
+# Check the values before touching anything on the server.
+rendered="$(mktemp)"
+trap 'rm -f "$rendered"' EXIT
+python3 "$HERE/render.py" "$HERE/app.yml" "$rendered"
+
 if [[ ! -d $TARGET/.git ]]; then
   git clone --depth 1 https://github.com/discourse/discourse_docker.git "$TARGET"
 else
@@ -24,10 +29,10 @@ else
 fi
 
 mkdir -p "$TARGET/containers"
-python3 "$HERE/render.py" "$HERE/app.yml" "$TARGET/containers/app.yml"
+install -m 600 "$rendered" "$TARGET/containers/app.yml"
 
 cd "$TARGET"
-# The launcher asks before continuing on low memory; answer yes when running unattended.
+# Skip the interactive prerequisite checks (they cannot be answered from a workflow).
 ./launcher rebuild app --skip-prereqs
 
 host="${FORUM_HOSTNAME:-forum.sqlinsight.seosoft.dk}"