diff --git a/deploy.sh b/deploy.sh
index 781d49b..686f9a0 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -107,33 +107,39 @@ ZORAXY_DNS
         sleep 2
     done
 
-    # Fetch CSRF token from Zoraxy login page
-    CSRF_TOKEN=$(curl -s http://127.0.0.1:8000/ | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+    # Fetch CSRF token AND session cookie from Zoraxy login page (follow redirect)
+    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+    rm -f "$COOKIE_JAR"
+    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
+    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
     if [ -z "$CSRF_TOKEN" ]; then
         echo "[WARN] Could not fetch CSRF token, trying without it..."
-        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
+        ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
             -d "username=${ADMIN_USERNAME:-admin}" \
             -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
     else
-        ADMIN_CREATE=$(curl -s -X POST "$ZORAXY_ADMIN_URL" \
+        echo "[OK] CSRF token acquired"
+        ADMIN_CREATE=$(curl -s -b "$COOKIE_JAR" -X POST "$ZORAXY_ADMIN_URL" \
             -H "X-CSRF-Token: $CSRF_TOKEN" \
-            -d "username=${ADMIN_USERNAME:-admin}" \
-            -d "password=${ADMIN_PASSWORD:-admin}" 2>&1)
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1)
     fi
 
     if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"User registered\|"registered'; then
         echo "[OK] Zoraxy admin account created"
     elif echo "$ADMIN_CREATE" | grep -qi '"error'; then
-        echo "[WARN] Admin account may already exist: $ADMIN_CREATE"
+        echo "[WARN] Admin account create issue: $ADMIN_CREATE"
     else
         echo "[INFO] Admin API response: $ADMIN_CREATE"
     fi
 
     # --- Login to Zoraxy API for authenticated operations ---
     echo "[*] Logging in to Zoraxy API..."
-    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
-    rm -f "$COOKIE_JAR"
-    LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+    # Re-fetch CSRF token with fresh cookies for login
+    LOGIN_PAGE=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/)
+    CSRF_TOKEN=$(echo "$LOGIN_PAGE" | grep -oP '(?<=<meta name="zoraxy.csrf.Token" content=")[^"]+' || echo "")
+    LOGIN_RESPONSE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
+        -H "X-CSRF-Token: ${CSRF_TOKEN}" \
         -d "username=${ADMIN_USERNAME:-master}" \
         -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}")