diff --git a/scripts/setup/machine-setup/lib/base.sh b/scripts/setup/machine-setup/lib/base.sh
index 15f4f702..ec209b5d 100644
--- a/scripts/setup/machine-setup/lib/base.sh
+++ b/scripts/setup/machine-setup/lib/base.sh
@@ -100,6 +100,11 @@ fail() {
 
 ANSWERS_FILE="${ANSWERS_FILE:-}"
 
+# DOCKER_NETWORK included so officer-setup's Proxy step lands on the SAME bridge Docker
+# was told to use here, rather than each script independently defaulting to "services" and
+# happening to agree only because nobody has customised either yet. lib/docker.sh sets
+# DOCKER_NETWORK at source time (SETUP_DOCKER_NETWORK env var, else "services"), so it is
+# always defined by the time this runs, regardless of whether the Docker step itself ran.
 save_answers() {
   [[ -n "$ANSWERS_FILE" ]] || return 0
   cat >"$ANSWERS_FILE" <<EOF
@@ -107,6 +112,7 @@ save_answers() {
 MACHINE_ROLE=${MACHINE_ROLE}
 SETUP_USERNAME=${USERNAME}
 OFFICER_ROOT=${OFFICER_ROOT}
+SETUP_DOCKER_NETWORK=${DOCKER_NETWORK}
 EOF
   chmod 600 "$ANSWERS_FILE"
 }
diff --git a/scripts/setup/officer-setup.sh b/scripts/setup/officer-setup.sh
index 547302a9..2ea71be9 100755
--- a/scripts/setup/officer-setup.sh
+++ b/scripts/setup/officer-setup.sh
@@ -145,6 +145,13 @@ else
   echo "     would have answered are asked below instead."
 fi
 
+# proxy.sh set PROXY_NET from $SETUP_DOCKER_NETWORK when it was SOURCED, before the answers
+# file above could have populated that variable — so it needs re-deriving now the same way
+# ENV_PORT/ENV_PUBLIC_URL/POSTGRES_URL are recovered below. Without this a customised bridge
+# name from machine-setup silently would not carry over, and Proxy would default back to
+# "services" regardless of what Docker was actually told to use.
+PROXY_NET="${SETUP_DOCKER_NETWORK:-$PROXY_NET}"
+
 # ── the account ──
 #
 # A remembered answer can go stale: the account it names may have been renamed or
diff --git a/scripts/setup/officer-setup/lib/env.sh b/scripts/setup/officer-setup/lib/env.sh
index 12e37bb1..c7078ddd 100644
--- a/scripts/setup/officer-setup/lib/env.sh
+++ b/scripts/setup/officer-setup/lib/env.sh
@@ -31,14 +31,32 @@ env_exists() { [[ -f "$(env_file)" ]]; }
 
 # One value out of an existing .env, without sourcing it — the file holds
 # secrets and arbitrary shell would run as root.
+#
+# Checks the OFFICERDEV_-prefixed key first, matching the priority `OFFICERDEV_X ?? X`
+# gives it at runtime — write_env ALWAYS writes prefixed keys (see below), so plain `env_get
+# PORT` used to compare against a key that could never appear in a file this script wrote,
+# and always came back empty. That silently defeated the resume block below it was written
+# to fix, and the Environment step's own re-run showed the wrong default. Verified against a
+# real written .env: `env_get PORT` -> [], `env_get OFFICERDEV_PORT` -> [9000], before this.
+# Falls back to the bare key so an old, hand-written unprefixed file still works, same as the
+# runtime does.
 env_get() {
   [[ -r "$(env_file)" ]] || return 0
-  awk -F= -v k="$1" '
-    $1 == k {
+  awk -F= -v k="$1" -v pk="OFFICERDEV_$1" '
+    $1 == pk {
       v = substr($0, index($0, "=") + 1)
       gsub(/^"|"$/, "", v)
       print v
       exit
+    }
+    $1 == k && !found {
+      v = substr($0, index($0, "=") + 1)
+      gsub(/^"|"$/, "", v)
+      bare = v
+      found = 1
+    }
+    END {
+      if (bare != "") print bare
     }' "$(env_file)"
 }
 
diff --git a/scripts/setup/officer-setup/lib/postgres.sh b/scripts/setup/officer-setup/lib/postgres.sh
index dddd20c4..1d7e19fe 100644
--- a/scripts/setup/officer-setup/lib/postgres.sh
+++ b/scripts/setup/officer-setup/lib/postgres.sh
@@ -237,9 +237,19 @@ ENVF
   return 0
 }
 
+# Failure has to mean failure. The bare awk one-liner this replaced printed nothing and
+# still exited 0 when the file existed but had no POSTGRES_PASSWORD= line — so the caller's
+# `pg_compose_exists && PG_EXISTING_PASSWORD="$(pg_password_from_env_file)"` treated that as
+# success with an EMPTY password, and built POSTGRES_URL with a blank credential instead of
+# falling through to provision fresh. Only reachable via a hand-edited/corrupted .env, since
+# write_pg_compose always writes the line — but "reuse a blank password" is the wrong
+# direction to fail in even for an edge case that rare.
 pg_password_from_env_file() {
   [[ -r "$(pg_env_file)" ]] || return 1
-  awk -F= '/^POSTGRES_PASSWORD=/ { print substr($0, index($0, "=") + 1); exit }' "$(pg_env_file)"
+  local pw
+  pw="$(awk -F= '/^POSTGRES_PASSWORD=/ { print substr($0, index($0, "=") + 1); exit }' "$(pg_env_file)")"
+  [[ -n "$pw" ]] || return 1
+  printf '%s' "$pw"
 }
 
 pg_compose_up() { as_owner "docker compose --project-directory '$(pg_service_dir)' up -d" /; }
diff --git a/scripts/setup/officer-setup/lib/preflight.sh b/scripts/setup/officer-setup/lib/preflight.sh
index 1b5570f9..9e12ec1c 100644
--- a/scripts/setup/officer-setup/lib/preflight.sh
+++ b/scripts/setup/officer-setup/lib/preflight.sh
@@ -32,6 +32,13 @@ load_machine_answers() {
       MACHINE_ROLE) if [[ -z "$MACHINE_ROLE" ]]; then MACHINE_ROLE="$value"; fi ;;
       SETUP_USERNAME) if [[ -z "$USERNAME" ]]; then USERNAME="$value"; fi ;;
       OFFICER_ROOT) if [[ -z "$OFFICER_ROOT" ]]; then OFFICER_ROOT="$value"; fi ;;
+      # The bridge machine-setup told Docker to use — proxy.sh's PROXY_NET otherwise
+      # defaults to "services" independently and can only agree with this by coincidence.
+      # PROXY_NET is a top-level assignment evaluated when proxy.sh is SOURCED, which
+      # happens before this function is ever called — officer-setup.sh re-derives it from
+      # SETUP_DOCKER_NETWORK right after calling this, same pattern as ENV_PORT/
+      # ENV_PUBLIC_URL/POSTGRES_URL below it.
+      SETUP_DOCKER_NETWORK) if [[ -z "${SETUP_DOCKER_NETWORK:-}" ]]; then SETUP_DOCKER_NETWORK="$value"; fi ;;
     esac
   done <"$MACHINE_ANSWERS"
   return 0