diff --git a/deploy.sh b/deploy.sh
index 75658a5..b027255 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -264,84 +264,87 @@ EOF
     done
     sleep 1
 
-    # Shared cookie jar for CSRF-authenticated Zoraxy API calls
+    # Zoraxy API helper — uses direct /login.html to avoid redirect CSRF issues
     COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+    rm -f "$COOKIE_JAR"
 
-    # Helper: fetch CSRF token from Zoraxy login page (uses $COOKIE_JAR)
     fetch_csrf() {
-        rm -f "$COOKIE_JAR"
+        # Fetch /login.html directly (no redirect), save cookies, extract token
         local page
-        page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)
+        page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
         local token
-        token=$(echo "$page" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+        token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//' | head -1)
         echo "$token"
     }
 
+    zoraxy_post() {
+        local path="$1" data="$2"
+        local csrf
+        csrf=$(fetch_csrf)
+        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000${path}" \
+            -H "X-CSRF-Token: ${csrf}" -d "${data}"
+    }
+
+    zoraxy_get() {
+        local path="$1" data="$2"
+        local csrf
+        csrf=$(fetch_csrf)
+        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000${path}" \
+            -H "X-CSRF-Token: ${csrf}" -G ${data:+-d "$data"}
+    }
+
     # Step 1: Create admin account
     echo "  Creating admin account..."
     CSRF=$(fetch_csrf)
-    if [ -z "$CSRF" ]; then
-        echo "  [WARN] Could not fetch CSRF token — trying registration without it"
-        ADMIN_RESULT=$(curl -s -X POST "http://127.0.0.1:8000/api/auth/register" \
-            -d "username=${ADMIN_USERNAME:-master}" \
-            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
-    else
-        ADMIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
-            -H "X-CSRF-Token: $CSRF" \
-            -d "username=${ADMIN_USERNAME:-master}" \
-            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
-    fi
+    ADMIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
+        -H "X-CSRF-Token: ${CSRF}" \
+        -d "username=${ADMIN_USERNAME:-master}" \
+        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
 
     if echo "$ADMIN_RESULT" | grep -qi '"success"\|"ok"\|"registered'; then
         echo "  [OK] Admin account created: $ADMIN_USERNAME"
     elif echo "$ADMIN_RESULT" | grep -qi 'already\|exist'; then
         echo "  [OK] Admin account already exists"
     else
-        echo "  [INFO] Admin registration response: $ADMIN_RESULT"
+        echo "  [INFO] Admin registration: $ADMIN_RESULT"
     fi
 
-    # Step 2: Login with Zoraxy admin for LE configuration
+    # Step 2: Login (saves session cookie in $COOKIE_JAR)
     echo "  Logging in for LE configuration..."
     CSRF=$(fetch_csrf)
-    if [ -z "$CSRF" ]; then
-        echo "  [WARN] No CSRF token — skipping LE automation"
+    LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+        -H "X-CSRF-Token: ${CSRF}" \
+        -d "username=${ADMIN_USERNAME:-master}" \
+        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
+
+    if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
+        echo "  [OK] Logged in as $ADMIN_USERNAME"
+
+        # Set LE email
+        echo "  Setting Let's Encrypt email: ${TLS_EMAIL}"
+        zoraxy_post "/api/acme/autoRenew/email" "set=${TLS_EMAIL}" > /dev/null
+
+        # Obtain certificates for all subdomains
+        LE_CA="Let%27s%20Encrypt"
+        for SUB in app dns; do
+            echo "  Requesting LE certificate for ${SUB}.${DOMAIN}..."
+            CERT_RESULT=$(curl -s --max-time 60 -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
+                -H "X-CSRF-Token: $(fetch_csrf)" \
+                -G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
+                -d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
+            if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed\|true'; then
+                echo "  [OK] Certificate obtained for ${SUB}.${DOMAIN}"
+            else
+                echo "  [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
+            fi
+        done
+
+        # Enable auto-renew
+        echo "  Enabling auto-renew..."
+        zoraxy_post "/api/acme/autoRenew/enable" "enable=true" > /dev/null
+        echo "  [OK] LE auto-renew enabled"
     else
-        LOGIN_RESULT=$(curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
-            -H "X-CSRF-Token: $CSRF" \
-            -d "username=${ADMIN_USERNAME:-master}" \
-            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
-
-        if echo "$LOGIN_RESULT" | grep -qi '"success"\|"ok"'; then
-            echo "  [OK] Logged in as $ADMIN_USERNAME"
-
-            # Set LE email
-            echo "  Setting Let's Encrypt email: ${TLS_EMAIL}"
-            curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/email" \
-                -d "set=${TLS_EMAIL}" > /dev/null
-
-            # Obtain certificates for all subdomains (30s timeout each)
-            # URL-encode "Let's Encrypt" as Let%27s%20Encrypt to avoid curl parsing issues
-            LE_CA="Let%27s%20Encrypt"
-            for SUB in app dns; do
-                echo "  Requesting LE certificate for ${SUB}.${DOMAIN}..."
-                CERT_RESULT=$(curl -s --max-time 30 -b "$COOKIE_JAR" -X GET "http://127.0.0.1:8000/api/acme/obtainCert" \
-                    -G -d "domains=${SUB}.${DOMAIN}" -d "filename=${SUB}.${DOMAIN}" \
-                    -d "email=${TLS_EMAIL}" -d "ca=${LE_CA}" -d "dns=false" 2>&1)
-                if echo "$CERT_RESULT" | grep -qi '"success"\|"ok"\|"installed'; then
-                    echo "  [OK] Certificate obtained for ${SUB}.${DOMAIN}"
-                else
-                    echo "  [INFO] ${SUB}.${DOMAIN}: $CERT_RESULT (expected if DNS doesn't resolve)"
-                fi
-            done
-
-            # Enable auto-renew
-            echo "  Enabling auto-renew..."
-            curl -s -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/acme/autoRenew/enable" \
-                -d "enable=true" > /dev/null
-            echo "  [OK] LE auto-renew enabled"
-        else
-            echo "  [WARN] Login failed: $LOGIN_RESULT"
-        fi
+        echo "  [WARN] Login failed: $LOGIN_RESULT"
     fi
 
     # Restart Zoraxy to pick up configs