diff --git a/internal/services/db_updater/main.go b/internal/services/db_updater/main.go
index 7418a41..66072e2 100644
--- a/internal/services/db_updater/main.go
+++ b/internal/services/db_updater/main.go
@@ -44,9 +44,18 @@ func fetchDbs() {
 		// restart (which then fails to open the empty file). Back the file up
 		// first so we can restore it on failure.
 		backup, backupErr := backupMmdb()
+		if backupErr != nil {
+			// We could not back up the current canonical mmdb. Do NOT proceed:
+			// mergeMmdb() truncates the canonical file before writing, and with
+			// no backup a later merge/reload failure would leave it corrupt
+			// (unrecoverable on restart). Keep serving the current DB and let
+			// the next run retry.
+			log.Err(backupErr).Msg("Failed to back up mmdb, skipping rebuild")
+			return
+		}
 		if err := mergeMmdb(); err != nil {
 			log.Err(err).Msg("Failed to merge mmdb")
-			rollBackMmdb(backup, backupErr)
+			rollBackMmdb(backup)
 			return
 		}
 
@@ -55,7 +64,7 @@ func fetchDbs() {
 			log.Err(err).Msg("Failed to reload mmdb")
 			// Reload failed on the newly merged file: restore the previous
 			// canonical mmdb so we keep serving known-good data.
-			rollBackMmdb(backup, backupErr)
+			rollBackMmdb(backup)
 			return
 		}
 
@@ -103,10 +112,10 @@ func backupMmdb() (string, error) {
 
 // rollBackMmdb restores the canonical mmdb from backup (if any) and deletes
 // the etag files so the next cron run re-downloads and retries the merge.
-func rollBackMmdb(backup string, backupErr error) {
-	if backupErr != nil {
-		log.Err(backupErr).Msg("No mmdb backup available; cannot restore")
-	} else if backup != "" {
+// backup is "" on a first-ever build (no canonical file existed to back up),
+// in which case there is nothing to restore.
+func rollBackMmdb(backup string) {
+	if backup != "" {
 		if err := osx.Copy(backup, configs.MmdbDbFile); err != nil {
 			log.Err(err).Msg("Failed to restore mmdb backup")
 		} else {