diff --git a/deploy/bootstrap.sh b/deploy/bootstrap.sh
index 3a3f5d3..1ea9bae 100644
--- a/deploy/bootstrap.sh
+++ b/deploy/bootstrap.sh
@@ -1947,8 +1947,9 @@ persisted_auth_source_blocks() {
   for f in "${STATE_DIR}/felis.host.toml" "${STATE_DIR}/felis.pod.toml"; do
     [ -r "$f" ] || continue
     # Every [[auth_source]] table, up to (not including) the next other section header.
-    awk '/^[[:space:]]*\[\[auth_source\]\]/ { f=1 }
-         f && /^[[:space:]]*\[/ && !/^[[:space:]]*\[\[auth_source\]\]/ { f=0 }
+    # TOML also accepts [[ auth_source ]] and a quoted key; a header this does not
+    # recognise would silently drop that table.
+    awk '/^[[:space:]]*\[/ { f = /^[[:space:]]*\[\[[[:space:]]*["\047]?auth_source["\047]?[[:space:]]*\]\]/ }
          f { print }' "$f"
     return 0
   done
diff --git a/deploy/bootstrap_test.sh b/deploy/bootstrap_test.sh
index 86b0d3b..138f236 100644
--- a/deploy/bootstrap_test.sh
+++ b/deploy/bootstrap_test.sh
@@ -179,6 +179,19 @@ out="$(run_carry)"
 expect "both encoder-written tables are carried (first)" '  tag = "littleskin"' "$out"
 expect "both encoder-written tables are carried (second)" '  tag = "guild"' "$out"
 
+# TOML allows spaces inside the brackets and a quoted key. Each is still the operator's table.
+for hdr in '[[ auth_source ]]' '[["auth_source"]]' "[['auth_source']]"; do
+  printf '%s\n' "$hdr" 'tag = "guild"' 'prefix = "GD"' 'url = "https://b.example"' '' \
+    '[smtp]' 'host = "mail.example"' > "$sdir/felis.host.toml"
+  out="$(run_carry)"
+  expect "a $hdr header is carried" "$hdr" "$out"
+  expect "a $hdr table keeps its keys" 'tag = "guild"' "$out"
+  case "$out" in
+    *"[smtp]"*) echo "FAIL a $hdr table must stop at the next section:"; echo "$out"; fails=$((fails + 1)) ;;
+    *) echo "PASS a $hdr table stops at the next section" ;;
+  esac
+done
+
 # --- write_nano_config leaves the unit able to read its config ---------------------------
 # felis-nano runs as a DynamicUser, so the directory must be searchable by others under a
 # hardened umask too -- but an existing one, which the full install locks to 0700 for its