diff --git a/deploy.sh b/deploy.sh
index 93abc04..d57a30e 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -81,6 +81,25 @@ if [ ! -f backend/.env ]; then
 fi
 echo "  ✓ backend/.env exists"
 
+# Validate that critical backend env vars are actually set (not placeholders)
+check_backend_env() {
+    local var_name="$1"
+    local value
+    value=$(grep -E "^${var_name}=" backend/.env | cut -d= -f2- | tr -d '"' | tr -d "'")
+    if [ -z "$value" ] || [[ "$value" == *"your_"* ]]; then
+        echo ""
+        echo "Error: ${var_name} is not configured in backend/.env"
+        echo "  Open backend/.env and set a real value for ${var_name}"
+        exit 1
+    fi
+    echo "  ✓ ${var_name} is set"
+}
+
+check_backend_env GEMINI_API_KEY
+check_backend_env AZURE_TENANT_ID
+check_backend_env AZURE_CLIENT_ID
+check_backend_env DATABASE_URL
+
 # --- 1. Pull latest code (skip if not a git repo or no remote) ---
 echo ""
 echo "[1/6] Updating code..."