diff --git a/apps/api/src/auth/middleware.ts b/apps/api/src/auth/middleware.ts
index 82e5247..494cf0d 100644
--- a/apps/api/src/auth/middleware.ts
+++ b/apps/api/src/auth/middleware.ts
@@ -80,11 +80,26 @@ export async function oidcConfigFallbackMiddleware(c: Context, next: Next): Prom
         .limit(1);
 
       if (row?.value) {
-        // Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up
-        // This is safe: these are non-secret, app-config-owned values (D-01)
-        if (key === 'oidc_issuer') process.env.OIDC_ISSUER = row.value;
-        if (key === 'oidc_client_id') process.env.OIDC_CLIENT_ID = row.value;
-        if (key === 'app_external_url') process.env.OIDC_AUTH_EXTERNAL_URL = row.value;
+        // Inject into process.env so oidcAuthMiddleware()'s env(c) picks it up.
+        // This is safe: these are non-secret, app-config-owned values (D-01).
+        //
+        // WR-03 — single-write semantics: once written, process.env is NOT re-read
+        // from DB on subsequent requests (the needsXxx guard above is false once set).
+        // Consequence: if the operator changes these values via the wizard after the
+        // container is already running, the in-process value is stale until restart.
+        // A container restart is required to pick up any changed OIDC config values.
+        if (key === 'oidc_issuer') {
+          console.info('[oidcFallback] Writing OIDC_ISSUER from app_config — container restart required to update this value');
+          process.env.OIDC_ISSUER = row.value;
+        }
+        if (key === 'oidc_client_id') {
+          console.info('[oidcFallback] Writing OIDC_CLIENT_ID from app_config — container restart required to update this value');
+          process.env.OIDC_CLIENT_ID = row.value;
+        }
+        if (key === 'app_external_url') {
+          console.info('[oidcFallback] Writing OIDC_AUTH_EXTERNAL_URL from app_config — container restart required to update this value');
+          process.env.OIDC_AUTH_EXTERNAL_URL = row.value;
+        }
       }
     }
   }