diff --git a/deploy.sh b/deploy.sh
index 988c054..efd4c6d 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -264,9 +264,11 @@ EOF
     done
     sleep 1
 
-    # Helper: fetch CSRF token + cookie jar from Zoraxy login page
+    # Shared cookie jar for CSRF-authenticated Zoraxy API calls
+    COOKIE_JAR="/tmp/zoraxy_cookies.txt"
+
+    # Helper: fetch CSRF token from Zoraxy login page (uses $COOKIE_JAR)
     fetch_csrf() {
-        COOKIE_JAR="/tmp/zoraxy_cookies.txt"
         rm -f "$COOKIE_JAR"
         local page
         page=$(curl -sL -c "$COOKIE_JAR" http://127.0.0.1:8000/ 2>&1)