diff --git a/start.sh b/start.sh
index 275f075..588a199 100644
--- a/start.sh
+++ b/start.sh
@@ -17,6 +17,14 @@ if [[ ! -f "$ENV_FILE" ]]; then
   fi
 fi
 
+# Safe reader for existing values (does not fail under set -e -o pipefail)
+ini_val() {
+  local key="$1"
+  local val
+  val=$(awk -F'=' -v k="$key" 'BEGIN{found=0} $1==k{print substr($0, index($0,$2)); found=1} END{ if(!found){} }' "$ENV_FILE" 2>/dev/null || true)
+  echo -n "$val"
+}
+
 read -rp "Node privacy (public/private) [public]: " NODE_PRIVACY
 NODE_PRIVACY=${NODE_PRIVACY:-public}
 if [[ "$NODE_PRIVACY" != "public" && "$NODE_PRIVACY" != "private" ]]; then
@@ -24,30 +32,36 @@ if [[ "$NODE_PRIVACY" != "public" && "$NODE_PRIVACY" != "private" ]]; then
   NODE_PRIVACY=public
 fi
 
+# Helper to prompt only if missing in .env
+ask_or_keep() {
+  local key="$1"; shift
+  local prompt="$1"; shift
+  local def="$1"; shift || true
+  local cur
+  cur=$(ini_val "$key")
+  if [[ -n "$cur" ]]; then
+    echo "$key is set in .env; keeping existing value"
+    eval "$key=\"$cur\""
+  else
+    read -rp "$prompt [${def}]: " val || true
+    val=${val:-$def}
+    eval "$key=\"$val\""
+  fi
+}
+
 if [[ "$NODE_PRIVACY" == "private" ]]; then
-  read -rp "Public host URL (leave empty for private): " PUBLIC_HOST || true
+  # For private nodes, PUBLIC_HOST optional; only ask if missing
+  ask_or_keep PUBLIC_HOST "Public host URL (leave empty for private)" ""
 else
-  read -rp "Public host URL (e.g., https://node.example.com) [$(grep -E '^PUBLIC_HOST=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " PUBLIC_HOST || true
-  PUBLIC_HOST=${PUBLIC_HOST:-$(grep -E '^PUBLIC_HOST=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
+  ask_or_keep PUBLIC_HOST "Public host URL (e.g., https://node.example.com)" "$(ini_val PUBLIC_HOST)"
 fi
 
-read -rp "Internal app port (SANIC_PORT) [$(grep -E '^SANIC_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " SANIC_PORT || true
-SANIC_PORT=${SANIC_PORT:-$(grep -E '^SANIC_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
-
-read -rp "Published backend port on host (BACKEND_HTTP_PORT) [$(grep -E '^BACKEND_HTTP_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " BACKEND_HTTP_PORT || true
-BACKEND_HTTP_PORT=${BACKEND_HTTP_PORT:-$(grep -E '^BACKEND_HTTP_PORT=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
-
-read -rp "Bootstrap seeds (comma-separated URLs) [$(grep -E '^BOOTSTRAP_SEEDS=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " BOOTSTRAP_SEEDS || true
-BOOTSTRAP_SEEDS=${BOOTSTRAP_SEEDS:-$(grep -E '^BOOTSTRAP_SEEDS=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
-
-read -rp "Handshake interval seconds [$(grep -E '^HANDSHAKE_INTERVAL_SEC=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " HANDSHAKE_INTERVAL_SEC || true
-HANDSHAKE_INTERVAL_SEC=${HANDSHAKE_INTERVAL_SEC:-$(grep -E '^HANDSHAKE_INTERVAL_SEC=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
-
-read -rp "Telegram uploader bot token (TELEGRAM_API_KEY) [$(grep -E '^TELEGRAM_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " TELEGRAM_API_KEY || true
-TELEGRAM_API_KEY=${TELEGRAM_API_KEY:-$(grep -E '^TELEGRAM_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
-
-read -rp "Telegram client bot token (CLIENT_TELEGRAM_API_KEY) [$(grep -E '^CLIENT_TELEGRAM_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)]: " CLIENT_TELEGRAM_API_KEY || true
-CLIENT_TELEGRAM_API_KEY=${CLIENT_TELEGRAM_API_KEY:-$(grep -E '^CLIENT_TELEGRAM_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2)}
+ask_or_keep SANIC_PORT "Internal app port (SANIC_PORT)" "$(ini_val SANIC_PORT)"
+ask_or_keep BACKEND_HTTP_PORT "Published backend port on host (BACKEND_HTTP_PORT)" "$(ini_val BACKEND_HTTP_PORT)"
+ask_or_keep BOOTSTRAP_SEEDS "Bootstrap seeds (comma-separated URLs)" "$(ini_val BOOTSTRAP_SEEDS)"
+ask_or_keep HANDSHAKE_INTERVAL_SEC "Handshake interval seconds" "$(ini_val HANDSHAKE_INTERVAL_SEC)"
+ask_or_keep TELEGRAM_API_KEY "Telegram uploader bot token (TELEGRAM_API_KEY)" "$(ini_val TELEGRAM_API_KEY)"
+ask_or_keep CLIENT_TELEGRAM_API_KEY "Telegram client bot token (CLIENT_TELEGRAM_API_KEY)" "$(ini_val CLIENT_TELEGRAM_API_KEY)"
 
 echo "Applying configuration to $ENV_FILE ..."