Replace direct .env overwrite with a unique temp file and mv so a partial write cannot leave a truncated environment file on disk.