diff --git a/src/hooks.server.ts b/src/hooks.server.ts
new file mode 100644
index 0000000..fd70449
--- /dev/null
+++ b/src/hooks.server.ts
@@ -0,0 +1,4 @@
+// hooks.server.ts intentionally minimal — CSRF is handled natively by SvelteKit
+// when the Origin header matches the request Host. For multi-domain setups,
+// trusted origins are declared in svelte.config.js via kit.csrf.checkOrigin / allowedOrigins.
+export {};
diff --git a/start.sh b/start.sh
new file mode 100755
index 0000000..b5b3965
--- /dev/null
+++ b/start.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# start.sh — build and launch humor-units production server
+set -e
+
+cd "$(dirname "$0")"
+
+echo "Building..."
+npx vite build
+
+echo "Starting server on 192.168.0.94:4078..."
+exec env \
+  PORT=4078 \
+  HOST=192.168.0.94 \
+  ORIGIN=http://192.168.0.94:4078 \
+  node build/index.js
diff --git a/svelte.config.js b/svelte.config.js
index ad116dc..6423e6e 100644
--- a/svelte.config.js
+++ b/svelte.config.js
@@ -3,7 +3,7 @@ import adapter from '@sveltejs/adapter-node';
 /** @type {import('@sveltejs/kit').Config} */
 const config = {
 	kit: {
-		adapter: adapter()
+		adapter: adapter(),
 	},
 	vitePlugin: {
 		dynamicCompileOptions: ({ filename }) =>