diff --git a/scripts/deploy-nas.ps1 b/scripts/deploy-nas.ps1
index 4d20577..b15f29f 100644
--- a/scripts/deploy-nas.ps1
+++ b/scripts/deploy-nas.ps1
@@ -57,14 +57,33 @@ $fullCommit = (git rev-parse HEAD).Trim()
 $commit = (git rev-parse --short=8 HEAD).Trim()
 $qaVersion = if ($env:PUBLIC_QA_VERSION) { $env:PUBLIC_QA_VERSION } else { "deploy-$timestamp" }
 $releaseManifestPath = Join-Path $dist "release-manifest.json"
-@{
-  app = "heros_web"
-  commit = $fullCommit
-  shortCommit = $commit
-  qaVersion = $qaVersion
-  generatedAt = (Get-Date).ToUniversalTime().ToString("o")
-} | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $releaseManifestPath -Encoding UTF8
-Write-Host "Wrote $releaseManifestPath for $commit ($qaVersion)"
+$writeReleaseManifest = $true
+if (Test-Path $releaseManifestPath -PathType Leaf) {
+  try {
+    $existingReleaseManifest = Get-Content -LiteralPath $releaseManifestPath -Raw | ConvertFrom-Json
+    if ($existingReleaseManifest.app -ne "heros_web") {
+      throw "Existing release manifest has unexpected app '$($existingReleaseManifest.app)'."
+    }
+    if ($existingReleaseManifest.commit -eq $fullCommit) {
+      $writeReleaseManifest = $false
+      Write-Host "Using existing $releaseManifestPath for $commit"
+    } else {
+      Write-Host "Replacing stale $releaseManifestPath commit $($existingReleaseManifest.commit) with $commit"
+    }
+  } catch {
+    throw "Invalid existing release manifest at $releaseManifestPath. $_"
+  }
+}
+if ($writeReleaseManifest) {
+  @{
+    app = "heros_web"
+    commit = $fullCommit
+    shortCommit = $commit
+    qaVersion = $qaVersion
+    generatedAt = (Get-Date).ToUniversalTime().ToString("o")
+  } | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $releaseManifestPath -Encoding UTF8
+  Write-Host "Wrote $releaseManifestPath for $commit ($qaVersion)"
+}
 
 $userHost = "$SshUser@$SshHost"
 $remoteTemp = "$RemoteRoot/.$($SiteName)_deploy_$timestamp"