diff --git a/scripts/secrets/push-host-keys.sh b/scripts/secrets/push-host-keys.sh
index 7dc8d88..7fa08d0 100755
--- a/scripts/secrets/push-host-keys.sh
+++ b/scripts/secrets/push-host-keys.sh
@@ -66,7 +66,14 @@ prompt_sudo_password() {
     sudo_password="$SUDO_PASS"
     return
   fi
-  read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password
+  # read exits non-zero when stdin is not a terminal (e.g. CI, background
+  # agents). Catch that and give a clear message rather than a silent exit.
+  if ! read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password; then
+    echo >&2
+    echo "ERROR: stdin is not a terminal -- cannot prompt for sudo password." >&2
+    echo "       Set SUDO_PASS=<password> in the environment and re-run." >&2
+    exit 1
+  fi
   echo >&2
 }