diff --git a/containers/libreportal/libreportal.sh b/containers/libreportal/libreportal.sh
index 8d7324d..4add1b9 100644
--- a/containers/libreportal/libreportal.sh
+++ b/containers/libreportal/libreportal.sh
@@ -115,7 +115,16 @@ installLibrePortal()
         echo "---- $menu_number. Generating all WebUI data files."
         echo ""
 
-        webuiLibrePortalUpdate;
+        # On a fresh (bootstrap) install startScan runs right after this and
+        # regenerates every data file — crucially AFTER scanConfigsForRandomPassword
+        # finalises app passwords, so that later pass is the authoritative one.
+        # Generating here as well would just be a premature duplicate, so defer to
+        # it. Standalone reinstalls (no bootstrap flag) still generate here.
+        if [[ "$libreportal_bootstrap_install" == "true" ]]; then
+            isNotice "Bootstrap install — deferring WebUI data generation."
+        else
+            webuiLibrePortalUpdate;
+        fi
 
         if [[ "$libreportal_bootstrap_install" != "true" ]]; then
             ((menu_number++))
diff --git a/scripts/webui/webui_updater.sh b/scripts/webui/webui_updater.sh
index ee8c111..4c5626a 100755
--- a/scripts/webui/webui_updater.sh
+++ b/scripts/webui/webui_updater.sh
@@ -4,11 +4,13 @@
 # Coordinates all webui data updates including system info and app configurations
 
 webuiLibrePortalUpdate() {
-    # Debounce: during a fresh install this function gets called back-to-back
-    # by installLibrePortal (line 113) and then startScan (end of preinstall),
-    # both within ~10 seconds. Skip if the last successful run is within the
-    # debounce window. Callers that genuinely need a forced refresh can set
-    # WEBUI_UPDATER_FORCE=1.
+    # Debounce safety net: if this function gets called twice in quick
+    # succession (e.g. two app installs in a row), skip the second run when the
+    # last successful one is within the debounce window. The fresh-install
+    # duplicate — installLibrePortal followed by startScan — is handled
+    # deterministically upstream (installLibrePortal defers to startScan during a
+    # bootstrap install), so this timer is only a backstop. Callers that
+    # genuinely need a forced refresh can set WEBUI_UPDATER_FORCE=1.
     local stamp_file="/tmp/libreportal_webui_updater_last"
     local debounce_seconds="${WEBUI_UPDATER_DEBOUNCE:-30}"
     if [[ -z "$WEBUI_UPDATER_FORCE" && -f "$stamp_file" ]]; then