diff --git a/deploy.sh b/deploy.sh
index d59b9ad..a753806 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -265,12 +265,26 @@ EOF
     sleep 1
 
     COOKIE_JAR="/tmp/zoraxy_cookies.txt"
-    rm -f "$COOKIE_JAR"
+
+    # Helper: fetch CSRF token from Zoraxy login page
+    # Uses $COOKIE_JAR — appends cookies, preserves existing session
     fetch_csrf() {
-        curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//'
+        local page
+        page=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" http://127.0.0.1:8000/login.html 2>&1)
+        local token
+        token=$(echo "$page" | grep 'zoraxy.csrf.Token' | sed 's/.*content="//;s/".*//')
+        echo "$token"
     }
 
+    # First call — fresh cookie jar
+    rm -f "$COOKIE_JAR"
     CSRF=$(fetch_csrf)
+    if [ -z "$CSRF" ]; then
+        echo "  [WARN] No CSRF token found, sleeping 3s and retrying..."
+        sleep 3
+        CSRF=$(fetch_csrf)
+    fi
+
     ADMIN_CREATE=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" -X POST "http://127.0.0.1:8000/api/auth/register" \
         -H "X-CSRF-Token: ${CSRF}" \
         -d "username=${ADMIN_USERNAME:-master}" \