diff --git a/libs/cli/langgraph_cli/deploy.py b/libs/cli/langgraph_cli/deploy.py
index e992587b5..12908393a 100644
--- a/libs/cli/langgraph_cli/deploy.py
+++ b/libs/cli/langgraph_cli/deploy.py
@@ -1682,6 +1682,13 @@ class CustomerRegistrySource:
     ) -> DeployOutcome:
         _ensure_customer_registry_source(existing)
         self.requested_placement.ensure_not_requested(existing.id)
+        if self.image_pull_secrets:
+            raise click.UsageError(
+                "Image pull secrets are fixed when a deployment is created. "
+                f"Deployment {existing.id} already exists, so drop "
+                "--image-pull-secret, or create a new deployment with a "
+                "different --name."
+            )
         image_uri, step = self._publish(ctx, step)
         _log_deploy_step(step, f"Updating deployment {existing.id}")
         updated = ctx.client.update_deployment(
diff --git a/libs/cli/tests/unit_tests/cli/test_deploy_command.py b/libs/cli/tests/unit_tests/cli/test_deploy_command.py
index 3aa5e8414..39847fd71 100644
--- a/libs/cli/tests/unit_tests/cli/test_deploy_command.py
+++ b/libs/cli/tests/unit_tests/cli/test_deploy_command.py
@@ -981,6 +981,23 @@ def test_image_pull_secret_cannot_update_an_existing_deployment(
     assert deploy_project.timeline == []
 
 
+def test_image_pull_secret_cannot_update_a_deployment_found_by_name(
+    deploy_project: DeployProject,
+) -> None:
+    deploy_project.control_plane.existing_deployments = [
+        {"id": "dep-ext", "name": "my-app", "source": "external_docker"}
+    ]
+
+    result = deploy_project.run(
+        "--image-uri", EXTERNAL_DIGEST, "--image-pull-secret", "regcred"
+    )
+
+    assert result.exit_code != 0
+    assert "--image-pull-secret" in result.output
+    assert deploy_project.docker.verbs() == []
+    assert _patch("dep-ext") not in deploy_project.timeline
+
+
 def test_updating_a_deployment_never_looks_up_listeners(
     deploy_project: DeployProject,
 ) -> None: