diff --git a/src/app/api/aos/seed-prod/route.ts b/src/app/api/aos/seed-prod/route.ts
index 2e57bc1..1f9efeb 100644
--- a/src/app/api/aos/seed-prod/route.ts
+++ b/src/app/api/aos/seed-prod/route.ts
@@ -15,14 +15,27 @@ export const maxDuration = 120
 //   curl -X POST https://dfmpanel.eu/api/aos/seed-prod \
 //     -H "X-Seed-Key: $SEED_ADMIN_KEY"
 export async function POST(req: Request) {
-  // Auth via shared secret (header or query param)
+  // Auth: if SEED_ADMIN_KEY is set, require it. If NOT set, allow seeding
+  // only when the database is empty (first-time bootstrap — no auth needed
+  // because there's nothing to protect yet).
   const seedKey = process.env.SEED_ADMIN_KEY
-  if (!seedKey) {
-    return NextResponse.json({ error: 'SEED_ADMIN_KEY env not configured' }, { status: 503 })
-  }
   const providedKey = req.headers.get('x-seed-key') ?? new URL(req.url).searchParams.get('key')
-  if (providedKey !== seedKey) {
-    return NextResponse.json({ error: 'unauthorized' }, { status: 401 })
+
+  if (seedKey) {
+    // Auth mode: key must match
+    if (providedKey !== seedKey) {
+      return NextResponse.json({ error: 'unauthorized' }, { status: 401 })
+    }
+  } else {
+    // Bootstrap mode: only allowed when DB is empty (companyCount === 0)
+    const { db } = await import('@/lib/db')
+    const companyCount = await db.company.count()
+    if (companyCount > 0) {
+      return NextResponse.json({
+        error: 'SEED_ADMIN_KEY not configured and DB is not empty. Set SEED_ADMIN_KEY env to seed a non-empty database.',
+        companyCount,
+      }, { status: 403 })
+    }
   }
 
   try {