diff --git a/scripts/create-proxmox-resource.sh b/scripts/create-proxmox-resource.sh
index 5d6ce11..f1e952d 100755
--- a/scripts/create-proxmox-resource.sh
+++ b/scripts/create-proxmox-resource.sh
@@ -289,11 +289,17 @@ fi
 # --- refuse to duplicate a host that's already really deployed ----------
 # Checked by hostName, not exact flake target: proxmox-server being
 # deployed also blocks --type lxc --host server, since both would carry
-# the same hosts/server/host.nix identity (hostName, hostId).
+# the same hosts/server/host.nix identity (hostName, hostId). But skip the
+# check when dt == flake_target -- that's not a duplicate, it's recreating
+# the canonical deployed target itself (e.g. redeploying nix-cache after
+# destroying its old VM/container to pick up new sops secrets), and the
+# later VMID-existence check already guards against clobbering a live
+# resource.
 if [[ "$allow_duplicate_host" -eq 0 ]]; then
   deployed_targets_json="$(nix eval --json --no-use-registries --no-accept-flake-config \
     --file "${repo_root}/variables.nix" deployedTargets)"
   for dt in $(echo "$deployed_targets_json" | jq -r '.[]'); do
+    [[ "$dt" == "$flake_target" ]] && continue
     dt_hostname="$(nix eval --raw --no-use-registries --no-accept-flake-config \
       "${repo_root}#nixosConfigurations.${dt}.config.networking.hostName" 2>/dev/null || true)"
     if [[ "$dt_hostname" == "$host" ]]; then