diff --git a/crates/xmedia-bot/src/config.rs b/crates/xmedia-bot/src/config.rs
index 4914fae..e8ed7a2 100644
--- a/crates/xmedia-bot/src/config.rs
+++ b/crates/xmedia-bot/src/config.rs
@@ -41,8 +41,14 @@ impl Config {
     let webhook_url = env::var("WEBHOOK_URL").ok().and_then(|s| s.parse().ok());
     let webhook_listen = env::var("WEBHOOK_LISTEN").ok().and_then(|s| s.parse().ok());
     let webhook_port = env::var("WEBHOOK_PORT").ok().and_then(|s| s.parse().ok());
-    let webhook_cert = env::var("WEBHOOK_CERT").ok();
-    let webhook_secret_token = env::var("WEBHOOK_SECRET_TOKEN").ok();
+    // Empty strings count as unset (e.g. `-e WEBHOOK_CERT=` to disable a
+    // value that would otherwise come from `.env`).
+    let webhook_cert = env::var("WEBHOOK_CERT")
+        .ok()
+        .filter(|s| !s.is_empty());
+    let webhook_secret_token = env::var("WEBHOOK_SECRET_TOKEN")
+        .ok()
+        .filter(|s| !s.is_empty());
 
         Config {
             admin_ids,
diff --git a/crates/xmedia-bot/src/main.rs b/crates/xmedia-bot/src/main.rs
index a5c5241..aedfa0b 100644
--- a/crates/xmedia-bot/src/main.rs
+++ b/crates/xmedia-bot/src/main.rs
@@ -96,7 +96,8 @@ async fn main() {
             .webhook_url
             .clone()
             .expect("WEBHOOK_URL is not set");
-        bot.set_webhook(url.clone()).await.unwrap();
+        // `webhooks::axum` calls set_webhook itself (with the full options,
+        // secret token included) — no explicit registration here.
         let listen = CONFIG.webhook_listen.expect("WEBHOOK_LISTEN is not set");
         let port = CONFIG.webhook_port.expect("WEBHOOK_PORT is not set");
         let mut options = webhooks::Options::new((listen, port).into(), url);