diff --git a/tests/lasuite-docs/install_steps.sh b/tests/lasuite-docs/install_steps.sh
index d3357a6..837e19f 100755
--- a/tests/lasuite-docs/install_steps.sh
+++ b/tests/lasuite-docs/install_steps.sh
@@ -60,6 +60,13 @@ echo "  lasuite-docs install_steps: wiring OIDC at install against keycloak ${KC
 # can be created independently — so the single deploy below picks up v2.
 CUR_VER=$(grep -E '^\s*SECRET_OIDC_RPCS_VERSION=' "$ENV_PATH" | tail -1 | cut -d= -f2 | tr -d '"\r' || echo "v1")
 NEW_NUM=$((${CUR_VER#v} + 1))
+# A previous warm canonical may have left the next version behind. Its value
+# belongs to an old Keycloak realm, so select a fresh version instead of
+# reusing it or failing promotion with Swarm's AlreadyExists error.
+STACK_NAME="${CCCI_APP_DOMAIN//./_}"
+while docker secret inspect "${STACK_NAME}_oidc_rpcs_v${NEW_NUM}" >/dev/null 2>&1; do
+  NEW_NUM=$((NEW_NUM + 1))
+done
 NEW_VER="v${NEW_NUM}"
 INSERT_LOG=$(abra app secret insert "$CCCI_APP_DOMAIN" oidc_rpcs "$NEW_VER" "$KC_SECRET" --no-input -C -o 2>&1) ||
   INSERT_LOG=$(script -qec "abra app secret insert $CCCI_APP_DOMAIN oidc_rpcs $NEW_VER $KC_SECRET --no-input -C -o" /dev/null 2>&1) ||