diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b8d64fc..64fdc12 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -128,8 +128,9 @@ if [ '${COPY_SHARED[$TARGET]}' = '1' ]; then
   if [ -z \"\${CADDY_BASICAUTH_HASH:-}\" ]; then
     echo '  WARN: CADDY_BASICAUTH_HASH not set in .env; keeping placeholder'
   else
+    # '|' delimiter: the bcrypt hash contains '/' characters.
     mkdir -p /home/dank/Containers/caddy
-    sed \"s/REPLACE_WITH_HASH/\${CADDY_BASICAUTH_HASH}/g\" dankclaw/Caddyfile \\
+    sed \"s|REPLACE_WITH_HASH|\${CADDY_BASICAUTH_HASH}|g\" dankclaw/Caddyfile \\
       > /home/dank/Containers/caddy/Caddyfile
   fi
 fi
diff --git a/tests/deployment_flow.bats b/tests/deployment_flow.bats
index c9c6782..96f429c 100644
--- a/tests/deployment_flow.bats
+++ b/tests/deployment_flow.bats
@@ -33,3 +33,15 @@ load helpers
     timeout 8 ssh -o BatchMode=yes -o ConnectTimeout=5 dank@dankserver 'true' 2>/dev/null \
         || skip "dankserver not reachable from this host"
 }
+
+# Regression: the Caddyfile render step in deploy.sh must survive a bcrypt
+# hash (which contains '/' characters). Reproduce the sed expression with a
+# slash-bearing hash and confirm the placeholder is replaced.
+@test "deploy.sh Caddyfile render survives a slash-bearing bcrypt hash" {
+    local hash='$2a$14$dndiQ9EaycJv0w3Gp2oAYO/xH6O9x2ZRhMLJdCxrgi9rMn1te9D/spy'
+    local rendered
+    rendered=$(sed "s|REPLACE_WITH_HASH|${hash}|g" "$REPO_ROOT/dankclaw/Caddyfile")
+    [ -n "$rendered" ]
+    [[ "$rendered" == *"${hash}"* ]]
+    ! grep -q 'REPLACE_WITH_HASH' <<< "$rendered"
+}