diff --git a/modules/backupbot.nix b/modules/backupbot.nix
index c59c598..a6f6e31 100644
--- a/modules/backupbot.nix
+++ b/modules/backupbot.nix
@@ -18,6 +18,10 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # Ensure the file ends in a newline before appending — backup-bot-two's .env.sample ends
+        # with a newline-less comment line, so a bare append would glue the var onto that comment
+        # (commenting it out). `$(tail -c1)` is empty iff the last byte is already a newline.
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env RESTIC_REPOSITORY /backups/restic
diff --git a/modules/drone.nix b/modules/drone.nix
index ebe6dff..4e1ed99 100644
--- a/modules/drone.nix
+++ b/modules/drone.nix
@@ -32,6 +32,9 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # ensure trailing newline before append (a recipe .env.sample may end without one, which
+        # would glue the var onto the last line — see modules/backupbot.nix for the bite).
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env LETS_ENCRYPT_ENV ""