diff --git a/cinny/lotus_deploy.sh b/cinny/lotus_deploy.sh
index b3a1436..1d84d8a 100755
--- a/cinny/lotus_deploy.sh
+++ b/cinny/lotus_deploy.sh
@@ -15,8 +15,14 @@ echo "[$(date '+%Y-%m-%d %H:%M:%S')] ===== Deploy triggered ====="
 
 # Load secrets (auth tokens etc — not in git)
 if [ -f /etc/lotus-deploy.env ]; then
-    # shellcheck disable=SC1091
-    set -a; source /etc/lotus-deploy.env; set +a
+    set -a
+    # This env file only exists on the deploy host at runtime, so shellcheck
+    # can't follow it. The directive must sit DIRECTLY above the `source` —
+    # on a compound `set -a; source …` line it binds to `set -a` and the
+    # SC1091 finding still fails CI.
+    # shellcheck source=/dev/null
+    source /etc/lotus-deploy.env
+    set +a
 fi
 
 cd "$REPO"