diff --git a/docker/stepca-prod/init-stepca.sh b/docker/stepca-prod/init-stepca.sh
index 069a6e7..160980d 100755
--- a/docker/stepca-prod/init-stepca.sh
+++ b/docker/stepca-prod/init-stepca.sh
@@ -22,7 +22,9 @@ ROOT_KEY="/root/ca-root/root.key"
 IMAGE="smallstep/step-ca@sha256:e9e8fa3262bf37b130962ffddbf6a64ac188f0bbb80959cf3ddc04c6bf294c3d"
 TAILNET_IP="$(tailscale ip -4)"
 
-[ -f "$ROOT_CRT" ] && [ -f "$ROOT_KEY" ] || { echo "FAIL: fleet root not found at $ROOT_CRT/$ROOT_KEY" >&2; exit 1; }
+if [ ! -f "$ROOT_CRT" ] || [ ! -f "$ROOT_KEY" ]; then
+  echo "FAIL: fleet root not found at $ROOT_CRT/$ROOT_KEY" >&2; exit 1
+fi
 [ -n "$TAILNET_IP" ] || { echo "FAIL: no tailscale IP" >&2; exit 1; }
 if [ -d "$DATA" ] && [ "${1:-}" != "--reinit" ]; then
   echo "FAIL: $DATA exists (pass --reinit to wipe and redo)" >&2; exit 1