diff --git a/deploy.sh b/deploy.sh
index f8dfd13..781d49b 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -123,12 +123,81 @@ ZORAXY_DNS
 
     if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
         echo "[OK] Zoraxy admin account created"
-    elif echo "$ADMIN_CREATE" | grep -qi '"error"'; then
+    elif echo "$ADMIN_CREATE" | grep -qi '"error'; then
         echo "[WARN] Admin account may already exist: $ADMIN_CREATE"
     else
         echo "[INFO] Admin API response: $ADMIN_CREATE"
     fi
 
+    # --- Login to Zoraxy API for authenticated operations ---
+    echo "[*] Logging in to Zoraxy API..."
+    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+    rm -f "$COOKIE_JAR"
+    LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+        -d "username=${ADMIN_USERNAME:-master}" \
+        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}")
+
+    if echo "$LOGIN_RESPONSE" | grep -qi '"success"\|"ok"'; then
+        echo "[OK] Logged in as $ADMIN_USERNAME"
+    else
+        echo "[WARN] Login response: $LOGIN_RESPONSE"
+    fi
+
+    # --- Configure Let's Encrypt ---
+    echo "[*] Setting Let's Encrypt email..."
+    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
+        -d "set=${TLS_EMAIL}" > /dev/null
+
+    echo "[*] Obtaining certificates for app.${DOMAIN}..."
+    OBTAIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+        -G \
+        -d "domains=app.${DOMAIN}" \
+        -d "filename=app.${DOMAIN}" \
+        -d "email=${TLS_EMAIL}" \
+        -d "ca=Let's Encrypt" \
+        -d "dns=false" 2>&1)
+
+    if echo "$OBTAIN_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
+        echo "[OK] Let's Encrypt certificate obtained for app.${DOMAIN}"
+    else
+        echo "[INFO] Certificate result: $OBTAIN_RESULT"
+        echo "[INFO] This may fail in dev if DNS doesn't point here — auto-renew will retry."
+    fi
+
+    echo "[*] Enabling auto-renew..."
+    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
+        -d "enable=true" > /dev/null
+
+    # --- Configure ZorxAuth SSO ---
+    echo "[*] Configuring ZorxAuth SSO..."
+    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/provider" \
+        -d "enable=true" \
+        -d "name=NextWorkspace" \
+        -d "admin=${ADMIN_USERNAME}" > /dev/null
+
+    curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/sso/zorxauth/gateway" \
+        -d "redirect=https://app.${DOMAIN}/" > /dev/null
+
+    echo "[OK] ZorxAuth SSO configured"
+
+    # --- Generate launcher apps.yaml with actual domain ---
+    cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
+apps:
+  - name: "NextWorkspace"
+    subtitle: "Your Workspace"
+    url: "https://app.${DOMAIN}/"
+    icon: "home"
+  - name: "Admin"
+    subtitle: "Zoraxy Settings"
+    url: "https://dns.${DOMAIN}/"
+    icon: "settings"
+EOF
+
+    # --- Restart Zoraxy to apply config changes ---
+    echo "[*] Restarting Zoraxy to apply configs..."
+    podman-compose -f "$TARGET_DIR/compose/zoraxy.yaml" restart 2>&1 || true
+    sleep 2
+
     # Write systemd service and start launcher
     echo "[7/8] Writing systemd service and starting launcher..."
     cat > /etc/systemd/system/$SERVICE_NAME.service <<UNIT