diff --git a/phase1_gitea_unraid.sh b/phase1_gitea_unraid.sh
index 5a74daa..bf7aa77 100755
--- a/phase1_gitea_unraid.sh
+++ b/phase1_gitea_unraid.sh
@@ -129,6 +129,13 @@ if [[ -n "${GITEA_ADMIN_TOKEN:-}" ]]; then
 fi
 
 if [[ -z "${GITEA_ADMIN_TOKEN:-}" ]]; then
+  # Delete any stale token with the same name (idempotent re-run safety).
+  # Gitea returns 409 Conflict if a token with this name already exists.
+  curl -sf -u "${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASSWORD}" \
+    -X DELETE \
+    "${GITEA_INTERNAL_URL}/api/v1/users/${GITEA_ADMIN_USER}/tokens/migration-token" \
+    -o /dev/null 2>/dev/null || true
+
   # Generate token using basic auth (username:password).
   # The .sha1 field in the response contains the full token — this is the
   # ONLY time it's returned, so we must save it immediately.