diff --git a/targets/magisk_module/module/bin/bl_flasher.sh b/targets/magisk_module/module/bin/bl_flasher.sh
index 6439d2c11..fa0843be2 100644
--- a/targets/magisk_module/module/bin/bl_flasher.sh
+++ b/targets/magisk_module/module/bin/bl_flasher.sh
@@ -49,6 +49,7 @@ if [ "$LANG" = "zh" ]; then
   TEXT_ALL_OK="全部完成（含efisp）"
   TEXT_ALL_OK_NO_EFISP="全部完成（不含efisp）"
   TEXT_BUSY="任务正在运行"
+  TEXT_ALREADY_PROCESSED="当前槽与目标槽 ABL 已相同，疑似已处理过，拒绝重复刷写"
   TEXT_LOG_CLEARED="日志已清空"
 else
   TEXT_IDLE="Waiting"
@@ -84,6 +85,7 @@ else
   TEXT_ALL_OK="All done (with efisp)"
   TEXT_ALL_OK_NO_EFISP="All done (no efisp)"
   TEXT_BUSY="Task running"
+  TEXT_ALREADY_PROCESSED="Current and target ABL already match; refusing a likely duplicate flash"
   TEXT_LOG_CLEARED="Log cleared"
 fi
 
@@ -384,6 +386,7 @@ run_flash() {
   target_slot=$(other_slot "$current_slot")
   [ -z "$current_slot" ] && { write_state error "$TEXT_NO_SLOT"; exit 1; }
   [ -z "$target_slot" ] && { write_state error "$TEXT_NO_TARGET_SLOT"; exit 1; }
+
   write_state running "$TEXT_FLASHING $target_slot"
 
   abl=$(partition_path abl "$target_slot")
@@ -398,6 +401,17 @@ run_flash() {
     exit 0
   fi
 
+  # A successful OTA-retention run copies the current (old) ABL to the target
+  # slot. Refuse to run again once both ABL partitions match: rebuilding
+  # boot.efi at that point would use the already-replaced old ABL and overwrite
+  # the correct loader created by the first run.
+  current_abl=$(partition_path abl "$current_slot")
+  if [ -f "$EFISP_DIR/boot.efi" ] && cmp -s "$current_abl" "$abl"; then
+    write_log "$TEXT_ALREADY_PROCESSED ($current_slot -> $target_slot)"
+    write_state error "$TEXT_ALREADY_PROCESSED"
+    exit 0
+  fi
+
   efisp_fail=0
   if [ "$mode" = "update-efisp" ]; then
     update_efisp "$abl" no
diff --git a/targets/magisk_module/module/customize.sh b/targets/magisk_module/module/customize.sh
index b6b42142a..7803ca2cf 100644
--- a/targets/magisk_module/module/customize.sh
+++ b/targets/magisk_module/module/customize.sh
@@ -76,6 +76,7 @@ if [ "$LANG" = "zh" ]; then
   T_DONE_YES="安装完成，请重启到recovery进行格式化，格式化后请安装一次这个模块来完成安装，这时选否"
   T_SEL_NO="选择了否，正在安装OTA更新模块"
   T_DONE_NO="安装完成，请重启系统即可"
+  T_EXISTING_INSTALL="检测到已有 persist/efisp/boot.efi，自动按非首次安装处理并跳过启动分区写入"
 else
   T_VERIFY="- Verifying device model"
   T_DEVICE_OK="- Device verified:"
@@ -115,6 +116,7 @@ else
   T_DONE_YES="Install complete. Reboot to recovery and format data, then reinstall module and choose NO"
   T_SEL_NO="Selected NO, installing OTA update patch"
   T_DONE_NO="Install complete, please reboot"
+  T_EXISTING_INSTALL="Existing persist/efisp/boot.efi detected; treating this as an update and skipping boot-partition writes"
 fi
 
 ui_print "$T_VERIFY"
@@ -194,6 +196,17 @@ ui_print "$T_SOC"
 ui_print "$T_CHECK_EXP"
 current_slot=$(detect_current_slot)
 
+# A module update on an existing BDS install must never enter the destructive
+# fresh-install path because of an accidental Volume Up press. A real boot.efi
+# is a stronger signal than the directory alone, which may be left by a partial
+# or failed install.
+if grep -q " $PERSIST_MNT " /proc/mounts && [ -s "$EFISP_DIR/boot.efi" ]; then
+  ui_print "$T_EXISTING_INSTALL"
+  ui_print "$T_DONE_NO"
+  rm -rf "$RUNTIME_DIR" "$MODPATH/ablrepo"
+  exit 0
+fi
+
 ui_print "$T_INSTALL_CHOICE"
 ui_print "$T_VOL_UP"
 ui_print "$T_VOL_DOWN"