diff --git a/wwwroot/api/save_agreement_discount.dspy b/wwwroot/api/save_agreement_discount.dspy
index 21907b7..10e6e18 100644
--- a/wwwroot/api/save_agreement_discount.dspy
+++ b/wwwroot/api/save_agreement_discount.dspy
@@ -34,7 +34,7 @@ async with DBPools().sqlorContext(dbname) as sor:
             'productid': productid, 'prodtypeid': prodtypeid,
             'discount': new_discount, 'created_at': now,
         })
-        # Sync product_org_auth
+        # Sync product_org_auth (upsert — skip if exists)
         async with DBPools().sqlorContext(dbname) as s2:
             ag = await s2.sqlExe(
                 "SELECT sub_reseller_id FROM distribution_agreements WHERE id = ${aid}$",
@@ -42,10 +42,15 @@ async with DBPools().sqlorContext(dbname) as sor:
             )
         if ag:
             async with DBPools().sqlorContext('sage') as s3:
-                await s3.C('product_org_auth', {
-                    'id': getID(), 'product_id': productid,
-                    'org_id': ag[0].sub_reseller_id,
-                    'auth_source': 'distribution_agreement', 'auth_source_id': new_id,
-                })
+                existing = await s3.sqlExe(
+                    "SELECT id FROM product_org_auth WHERE product_id = ${pid}$ AND org_id = ${oid}$",
+                    {'pid': productid, 'oid': ag[0].sub_reseller_id}
+                )
+                if not existing:
+                    await s3.C('product_org_auth', {
+                        'id': getID(), 'product_id': productid,
+                        'org_id': ag[0].sub_reseller_id,
+                        'auth_source': 'distribution_agreement', 'auth_source_id': new_id,
+                    })
 
 return {'status': 'ok'}