diff --git a/app.py b/app.py
index 711a95b..1a9756d 100644
--- a/app.py
+++ b/app.py
@@ -285,11 +285,13 @@ def get_refresh_seconds():
 def get_hermes_api_key():
     """
     Return the effective Hermes API key.
-    Runtime settings override the environment variable so the key can be
-    regenerated from /admin/settings without redeploying.
+    Environment variable HERMES_API_KEY overrides any runtime setting.
     """
+    env_key = current_app.config.get('HERMES_API_KEY', '')
+    if env_key:
+        return env_key
     cfg = load_booth_settings()
-    return decrypt_value_legacy(cfg.get('hermes_api_key', '')) or current_app.config.get('HERMES_API_KEY', '')
+    return decrypt_value_legacy(cfg.get('hermes_api_key', ''))
 
 
 def set_hermes_api_key(key):