diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 130421a..fbfa76e 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -25,7 +25,7 @@ rsync -az --delete --filter='P _app/immutable/*' \
 # it needs only its code and the engine. Ledgers live outside this tree.
 rsync -az --delete --exclude='/server/node_modules' \
   --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' \
-  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' --include='/deploy/hash-tokens.ts' --include='/deploy/traffic.py' \
+  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' --include='/deploy/Caddyfile.tmpl' --include='/deploy/hash-tokens.ts' --include='/deploy/traffic.py' \
   --exclude='*' \
   ./ "root@$HOST:/opt/waving-hands/app/"
 
@@ -60,6 +60,12 @@ ssh "root@$HOST" '
   systemctl daemon-reload
   systemctl enable --now waving-hands
   systemctl restart waving-hands
+  # The site file is rendered from the template on every deploy, with the address line the box was set up with.
+  ADDR=$(head -1 /etc/caddy/sites/waving-hands.caddy | sed "s/ {\$//")
+  sed "s|__HOST__|$ADDR|" /opt/waving-hands/app/deploy/Caddyfile.tmpl > /etc/caddy/sites/waving-hands.caddy
+  caddy validate --config /etc/caddy/Caddyfile >/dev/null
+  # Validation as root touches the access logs; Caddy runs as caddy and must own them.
+  chown -R caddy:caddy /var/lib/caddy
   systemctl reload caddy
   sleep 1
   systemctl --no-pager -l status waving-hands | head -3