diff --git a/deploy.php b/deploy.php
index d2ec180..3ea1937 100644
--- a/deploy.php
+++ b/deploy.php
@@ -112,6 +112,27 @@ task('host:check', function () {
     }
 });
 
+desc('Put the secrets.php template into shared/ unless a secrets.php is there already (never overwrites)');
+task('typo3:secrets:init', function () {
+    $target = '{{deploy_path}}/shared/config/system/secrets.php';
+    if (test("[ -s $target ]")) {
+        return;
+    }
+    run('mkdir -p {{deploy_path}}/shared/config/system');
+    upload(__DIR__ . '/config/system/secrets.example.php', $target);
+    run("chmod 600 $target");
+    writeln('<comment>Created ' . parse($target) . ' from the template: fill it in, then deploy again.</comment>');
+});
+
+desc('Stop before the database is touched while secrets.php still lacks the database connection');
+task('typo3:secrets:check', function () {
+    $secrets = '{{deploy_path}}/shared/config/system/secrets.php';
+    $filled = run("{{bin/php}} -r '\$s = require \"$secrets\"; echo is_array(\$s) && (\$s[\"DB\"][\"Connections\"][\"Default\"][\"dbname\"] ?? \"\") !== \"\" ? \"yes\" : \"no\";'");
+    if ($filled !== 'yes') {
+        throw new \RuntimeException(parse("$secrets has no database connection yet: fill it in, then deploy again. Nothing went live."));
+    }
+});
+
 desc('Link the production fileadmin into the release');
 task('typo3:fileadmin', function () {
     run('test -d {{fileadmin_path}}');
@@ -127,9 +148,11 @@ task('deploy', [
     'deploy:lock',
     'deploy:release',
     'rsync',
+    'typo3:secrets:init',
     'deploy:shared',
     'typo3:fileadmin',
     'deploy:writable',
+    'typo3:secrets:check',
     // The schema has to exist before the new code starts serving traffic (adds and changes only).
     'typo3:extension:setup',
     // deploy:publish == deploy:symlink, deploy:unlock, deploy:cleanup, deploy:success