diff --git a/docker/logto-bootstrap.sh b/docker/logto-bootstrap.sh
index 481d3ce..730515b 100644
--- a/docker/logto-bootstrap.sh
+++ b/docker/logto-bootstrap.sh
@@ -58,7 +58,12 @@ apk add --no-cache jq curl >/dev/null 2>&1
 if [ -f "$BOOTSTRAP_FILE" ]; then
   CACHED_M2M_SECRET=$(jq -r '.m2mClientSecret // empty' "$BOOTSTRAP_FILE" 2>/dev/null)
   CACHED_TRAD_SECRET=$(jq -r '.tradAppSecret // empty' "$BOOTSTRAP_FILE" 2>/dev/null)
+  CACHED_SPA_ID=$(jq -r '.spaClientId // empty' "$BOOTSTRAP_FILE" 2>/dev/null)
   log "Found cached bootstrap file"
+  if [ -n "$CACHED_M2M_SECRET" ] && [ -n "$CACHED_SPA_ID" ]; then
+    log "Bootstrap already complete — skipping. Delete $BOOTSTRAP_FILE to force re-run."
+    exit 0
+  fi
 fi
 
 # ============================================================