diff --git a/src/config.rs b/src/config.rs
index 7bff3bc1..d84cae3b 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -883,7 +883,6 @@ impl std::fmt::Debug for SecretsConfig {
 /// Avoids re-prompting the OS keychain on every `SecretsConfig::resolve()` call
 /// (e.g. `Config::from_env()` then `Config::from_db()`). Thread-safe alternative
 /// to caching in a process env var.
-
 impl SecretsConfig {
     /// Auto-detect secrets master key from env var, then OS keychain.
     ///
@@ -1419,10 +1418,8 @@ fn optional_env(key: &str) -> Result<Option<String>, ConfigError> {
     }
 
     // Fall back to thread-safe overlay (secrets injected from DB)
-    if let Some(map) = INJECTED_VARS.get() {
-        if let Some(val) = map.get(key) {
-            return Ok(Some(val.clone()));
-        }
+    if let Some(val) = INJECTED_VARS.get().and_then(|map| map.get(key)) {
+        return Ok(Some(val.clone()));
     }
 
     Ok(None)
diff --git a/src/setup/channels.rs b/src/setup/channels.rs
index 4f942d83..34811358 100644
--- a/src/setup/channels.rs
+++ b/src/setup/channels.rs
@@ -623,7 +623,7 @@ pub async fn setup_wasm_channel(
         print_success(&format!("{} saved to database", secret_config.name));
     }
 
-    // TODO(#XX): Substitute secrets into the validation URL and make a
+    // TODO: Substitute secrets into the validation URL and make a
     // GET request to verify the configured credentials actually work.
     if let Some(ref validation_endpoint) = setup.validation_endpoint {
         print_info(&format!(
diff --git a/src/setup/wizard.rs b/src/setup/wizard.rs
index 2c85037d..0ccbddc6 100644
--- a/src/setup/wizard.rs
+++ b/src/setup/wizard.rs
@@ -1116,17 +1116,46 @@ impl SetupWizard {
             crypto
         };
 
-        // Create backend-appropriate secrets store
-        #[cfg(feature = "postgres")]
+        // Create backend-appropriate secrets store.
+        // Respect the user's selected backend when both features are compiled,
+        // so we don't accidentally use a postgres pool from DATABASE_URL when
+        // libsql was chosen (or vice versa).
+        let selected_backend = self
+            .settings
+            .database_backend
+            .as_deref()
+            .unwrap_or("postgres");
+
+        #[cfg(all(feature = "libsql", feature = "postgres"))]
         {
-            // Try postgres path first when postgres feature is available
+            if selected_backend == "libsql" {
+                if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+                if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+            } else {
+                if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+                if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
+                    return Ok(SecretsContext::from_store(store, "default"));
+                }
+            }
+        }
+
+        #[cfg(all(feature = "postgres", not(feature = "libsql")))]
+        {
+            let _ = selected_backend;
             if let Some(store) = self.create_postgres_secrets_store(&crypto).await? {
                 return Ok(SecretsContext::from_store(store, "default"));
             }
         }
 
-        #[cfg(feature = "libsql")]
+        #[cfg(all(feature = "libsql", not(feature = "postgres")))]
         {
+            let _ = selected_backend;
             if let Some(store) = self.create_libsql_secrets_store(&crypto)? {
                 return Ok(SecretsContext::from_store(store, "default"));
             }