diff --git a/deploy.sh b/deploy.sh
index a753806..1ebfdaf 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -276,27 +276,44 @@ EOF
         echo "$token"
     }
 
-    # First call — fresh cookie jar
+    # First call — fresh cookie jar, retry until we get a valid CSRF
     rm -f "$COOKIE_JAR"
-    CSRF=$(fetch_csrf)
-    if [ -z "$CSRF" ]; then
-        echo "  [WARN] No CSRF token found, sleeping 3s and retrying..."
-        sleep 3
+    CSRF=""
+    for i in $(seq 1 10); do
         CSRF=$(fetch_csrf)
+        if [ -n "$CSRF" ]; then
+            break
+        fi
+        echo "  Waiting for Zoraxy to be ready... ($i/10)"
+        sleep 3
+    done
+
+    # Try API registration first, fall back to BoltDB direct write
+    if [ -n "$CSRF" ]; then
+        ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
+            -H "X-CSRF-Token: ${CSRF}" \
+            -d "username=${ADMIN_USERNAME:-master}" \
+            -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) || true
+        if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
+            echo "  [OK] Admin account created: $ADMIN_USERNAME"
+        else
+            echo "  [INFO] API registration: $ADMIN_CREATE — trying BoltDB fallback"
+            CSRF=""  # Force fallback
+        fi
     fi
 
-    ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
-        -H "X-CSRF-Token: ${CSRF}" \
-        -d "username=${ADMIN_USERNAME:-master}" \
-        -d "password=${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" 2>&1) || true
-    if echo "$ADMIN_CREATE" | grep -qi '"success"\|"ok"\|"registered'; then
-        echo "  [OK] Admin account created: $ADMIN_USERNAME"
-    elif echo "$ADMIN_CREATE" | grep -qi 'already\|exist'; then
-        echo "  [OK] Admin account already exists"
-    else
-        echo "  [INFO] Admin registration: $ADMIN_CREATE"
+    # BoltDB fallback: write admin directly if API failed
+    if [ -z "$CSRF" ] && [ -f "$TOOL_BIN" ]; then
+        echo "  Creating admin via BoltDB..."
+        SYS_DB="$TARGET_DIR/data/zoraxy/sys.db"
+        if [ -f "$SYS_DB" ]; then
+            "$TOOL_BIN" db --db "$SYS_DB" \
+                --set "system:admin:{\"username\":\"${ADMIN_USERNAME:-master}\"}" 2>&1 || true
+            echo "  [OK] Admin written to BoltDB"
+        fi
     fi
 
+    # Login using API
     CSRF=$(fetch_csrf)
     LOGIN_RESULT=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/login" \
         -H "X-CSRF-Token: ${CSRF}" \