make update warns when .env lacks a key compose would default, like make up

Makefile

@@ -41,7 +41,7 @@ dev dev-utils dev-local dev-lan rebuild-frontend: export DOMAIN ?= localhost
 
 # A key the template lists and the compose files default, missing from .env,
 # falls back without a word. For TZ that means every cron runs on UTC. Only a
-# warning, so a start never fails over it.
+# warning, so a start never fails over it. `update` runs it after its pull.
 dev dev-local dev-lan up: env-check
 env-check:
 	@missing=$$(grep -ohE '\$$\{[A-Z_]+:?-' docker/compose*.yml | sed 's/^..//; s/:\{0,1\}-$$//' | sort -u \
@@ -134,6 +134,7 @@ umami:  ## Provision + start the optional Umami site-analytics service (idempote
 
 update:  ## Pull, rebuild using the layer cache, and recreate changed containers
 	git pull
+	@$(MAKE) --no-print-directory env-check
 	$(COMPOSE_PROD_RUN) build
 	$(COMPOSE_PROD_RUN) up -d --remove-orphans
 	docker image prune -f