diff --git a/deploy.sh b/deploy.sh
index 92689c8..b381f55 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -304,11 +304,11 @@ EOF
         FQDN="${SUB}.${DOMAIN}"
         CRT_FILE="$CERTS_DIR/${FQDN}.crt"
         [ -f "$CRT_FILE" ] || continue
-        for TRY in 1 2 3 4 5; do
-            C=$(curl -s -c /tmp/zc.txt http://127.0.0.1:8000/login.html)
+        for TRY in 1 2 3; do
+            C=$(curl -s --max-time 5 -c /tmp/zc.txt http://127.0.0.1:8000/login.html 2>&1)
             T=$(echo "$C" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
             [ -z "$T" ] && sleep 2 && continue
-            R=$(curl -s -b /tmp/zc.txt -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
+            R=$(curl -s --max-time 5 -b /tmp/zc.txt -X POST "http://127.0.0.1:8000/api/cert/upload?ktype=pub&domain=$FQDN" \
                 -H "X-CSRF-Token: $T" --data-binary "@$CRT_FILE" 2>&1) || true
             if echo "$R" | grep -qi '"success"\|"ok"\|^{}$'; then
                 echo "  [OK] Cert registered: $FQDN"
@@ -317,6 +317,7 @@ EOF
             sleep 2
         done
     done
+    echo "  [OK] Certificate registration complete"
 
     # Write systemd service
     echo "[*] Writing systemd service..."
diff --git a/install.sh b/install.sh
index e533d40..268ce5f 100755
--- a/install.sh
+++ b/install.sh
@@ -28,6 +28,10 @@ read -p "TLS email (Let's Encrypt): " TLS_EMAIL
 while [ -z "$TLS_EMAIL" ]; do
   read -p "TLS email (required): " TLS_EMAIL
 done
+# Basic email validation (must contain @)
+while echo "$TLS_EMAIL" | grep -qv '@'; do
+  read -p "Invalid email — must contain @: " TLS_EMAIL
+done
 
 read -p "Admin username: " ADMIN_USERNAME
 while [ -z "$ADMIN_USERNAME" ]; do