diff --git a/TODO.md b/TODO.md
index 3a1b5c5..0a21032 100644
--- a/TODO.md
+++ b/TODO.md
@@ -11,6 +11,10 @@ Pending tasks have been split into topic files under [`todo/`](todo/README.md):
 
 ## Recently completed (this session)
 
+- [x] `scripts/deploy-server.sh` — add step 4: `systemctl reload nginx` runs automatically; remove manual reload instruction from justfile
+
+- [x] `nginx/posterg.conf` — add `script-src 'self' 'unsafe-inline'` to admin CSP; `default-src 'self'` was blocking OverType init script and live-reload poller
+
 - [x] `RateLimit.php` — silence `mkdir()` with `@`; guard `file_put_contents` with `is_writable()` check so permission errors degrade gracefully (allow request, skip write) instead of spamming nginx error log
 - [x] `scripts/deploy-server.sh` + `scripts/setup-server.sh` — add `mkdir -p storage/cache/rate_limit` + `chown`/`chmod 2775` so php-fpm has write access on fresh deploys
 
diff --git a/justfile b/justfile
index 2d4b8fc..db69751 100644
--- a/justfile
+++ b/justfile
@@ -70,7 +70,6 @@ deploy-nginx:
     @echo "Files uploaded. SSH into the server and run:"
     @echo ""
     @echo "  sudo bash /tmp/deploy-server.sh"
-    @echo "  sudo systemctl reload nginx"
     @echo ""
 
 [group('deploy')]
diff --git a/nginx/posterg.conf b/nginx/posterg.conf
index 7d14ba9..bcdc030 100644
--- a/nginx/posterg.conf
+++ b/nginx/posterg.conf
@@ -123,8 +123,10 @@ server {
         # Rate limiting for admin
         limit_req zone=admin burst=20 nodelay;
 
-        # Content-Security-Policy - Tighter policy for admin
-        add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
+        # Content-Security-Policy - Admin policy
+        # script-src needs 'unsafe-inline' for the OverType editor init block
+        # and the live-reload poller (dev only). Admin is already auth-gated.
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
 
         # Disable directory listing
         autoindex off;
diff --git a/scripts/deploy-server.sh b/scripts/deploy-server.sh
index b4ed6bf..6e8d8b3 100755
--- a/scripts/deploy-server.sh
+++ b/scripts/deploy-server.sh
@@ -84,15 +84,21 @@ else
     exit 1
 fi
 
+# ── Step 4: Reload nginx ─────────────────────────────────────────────────────
+printf "\n"
+echo "📋 Step 4: Reloading nginx..."
+echo "------------------------------"
+
+systemctl reload nginx
+ok "Nginx reloaded"
+
 # ── Done ──────────────────────────────────────────────────────────────────────
 printf "\n"
 ok "Permissions fixed"
 ok "Nginx config installed"
 ok "Configuration validated"
-printf "\n"
-warn "Nginx has not been reloaded yet."
-printf "Run: sudo systemctl reload nginx\n\n"
-printf "After reload, verify:\n"
-printf "  • https://posterg.erg.be/\n"
-printf "  • https://posterg.erg.be/admin/\n"
-printf "  • https://posterg.erg.be/storage/posterg.db (should 403/404)\n"
+ok "Nginx reloaded"
+printf "\nVerify:\n"
+printf "  https://posterg.erg.be/\n"
+printf "  https://posterg.erg.be/admin/\n"
+printf "  https://posterg.erg.be/storage/posterg.db (should 403/404)\n"