diff --git a/.claude/skills/playwright-cli/SKILL.md b/.claude/skills/playwright-cli/SKILL.md
new file mode 100644
index 0000000..6c2b6cb
--- /dev/null
+++ b/.claude/skills/playwright-cli/SKILL.md
@@ -0,0 +1,230 @@
+---
+name: playwright-cli
+description: Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
+allowed-tools: Bash(playwright-cli:*)
+---
+
+# Browser Automation with playwright-cli
+
+## Quick start
+
+```bash
+# Open a browser through the proxy (proxy must be running)
+mise run browser -- https://example.is
+
+# Open a browser without the proxy (for comparison)
+mise run browser-no-proxy -- https://example.is
+
+# Interact with the proxy session
+playwright-cli -s=proxy snapshot
+playwright-cli -s=proxy screenshot --filename=tmp/with-proxy.png
+
+# Interact with the no-proxy session
+playwright-cli -s=no-proxy snapshot
+playwright-cli -s=no-proxy screenshot --filename=tmp/without-proxy.png
+```
+
+## Proxy testing workflow
+
+### Prerequisites
+
+The proxy must be running with a blocklist:
+
+```bash
+mise run dev -- --blocklist examples/is.rules
+```
+
+### 1. Open browser sessions
+
+```bash
+# Through the proxy (uses playwright-cli-proxy.json config for proxy + ignoreHTTPSErrors)
+mise run browser -- https://example.is
+
+# Without the proxy (for comparison)
+mise run browser-no-proxy -- https://example.is
+```
+
+### 2. Find rules for the target domain
+
+```bash
+# Element hiding rules (##)
+grep "example.is##" examples/is.rules
+
+# URL blocking rules (||)
+grep "||.*example" examples/is.rules
+
+# Global element hiding rules
+grep "^##" examples/is.rules
+```
+
+### 3. Verify element replacement
+
+Matched elements are replaced with `<!-- ublproxy: replaced .selector -->` comments in the DOM:
+
+```bash
+playwright-cli -s=proxy eval "() => {
+  const html = document.documentElement.innerHTML;
+  const matches = html.match(/<!-- ublproxy: replaced [^>]+ -->/g);
+  return { found: (matches || []).length, replacements: matches || [] };
+}"
+```
+
+### 4. Verify CSS fallback injection
+
+Complex selectors fall back to CSS `display: none` injection. Check for injected `<style>` tags:
+
+```bash
+playwright-cli -s=proxy eval "() => {
+  const injected = [...document.querySelectorAll('style')].filter(s =>
+    s.textContent.includes('display: none !important')
+  );
+  return {
+    found: injected.length > 0,
+    css: injected.map(s => s.textContent).join('')
+  };
+}"
+```
+
+### 5. Verify request blocking
+
+Check network log for failed requests to blocked domains:
+
+```bash
+playwright-cli -s=proxy network
+```
+
+Requests to blocked domains should appear as failed. Compare with the no-proxy session:
+
+```bash
+playwright-cli -s=no-proxy network
+```
+
+### 6. Take comparison screenshots
+
+```bash
+playwright-cli -s=proxy screenshot --filename=tmp/with-proxy.png
+playwright-cli -s=no-proxy screenshot --filename=tmp/without-proxy.png
+```
+
+### 7. Cleanup
+
+```bash
+playwright-cli -s=proxy close
+playwright-cli -s=no-proxy close
+```
+
+## Commands
+
+### Core
+
+```bash
+playwright-cli open [url]               # open browser, optionally navigate
+playwright-cli goto <url>               # navigate to a url
+playwright-cli close                    # close the browser
+playwright-cli type <text>              # type text into editable element
+playwright-cli click <ref>              # click an element
+playwright-cli fill <ref> <text>        # fill text into editable element
+playwright-cli hover <ref>              # hover over element
+playwright-cli select <ref> <val>       # select dropdown option
+playwright-cli check <ref>              # check a checkbox
+playwright-cli uncheck <ref>            # uncheck a checkbox
+playwright-cli snapshot                 # capture page snapshot (element refs)
+playwright-cli eval <func> [ref]        # evaluate javascript
+playwright-cli resize <w> <h>           # resize browser window
+```
+
+### Navigation
+
+```bash
+playwright-cli go-back
+playwright-cli go-forward
+playwright-cli reload
+```
+
+### Keyboard and mouse
+
+```bash
+playwright-cli press <key>              # press a key (Enter, ArrowDown, etc.)
+playwright-cli keydown <key>
+playwright-cli keyup <key>
+playwright-cli mousemove <x> <y>
+playwright-cli mousedown [button]
+playwright-cli mouseup [button]
+playwright-cli mousewheel <dx> <dy>
+```
+
+### Save as
+
+```bash
+playwright-cli screenshot               # screenshot of current page
+playwright-cli screenshot <ref>         # screenshot of element
+playwright-cli screenshot --filename=f  # save to specific file
+playwright-cli pdf --filename=page.pdf  # save page as pdf
+```
+
+### Tabs
+
+```bash
+playwright-cli tab-list
+playwright-cli tab-new [url]
+playwright-cli tab-close [index]
+playwright-cli tab-select <index>
+```
+
+### Network
+
+```bash
+playwright-cli route <pattern>          # mock network requests
+playwright-cli route-list               # list active routes
+playwright-cli unroute [pattern]        # remove routes
+playwright-cli network                  # list all network requests
+```
+
+### DevTools
+
+```bash
+playwright-cli console [min-level]      # list console messages
+playwright-cli run-code <code>          # run playwright code snippet
+playwright-cli tracing-start            # start trace recording
+playwright-cli tracing-stop             # stop trace recording
+```
+
+### Sessions
+
+```bash
+playwright-cli -s=name <cmd>            # run command in named session
+playwright-cli list                     # list all sessions
+playwright-cli close-all                # close all browsers
+playwright-cli kill-all                 # forcefully kill all browsers
+```
+
+### Open parameters
+
+```bash
+playwright-cli open --browser=chrome    # use specific browser
+playwright-cli open --config=file.json  # use config file
+playwright-cli open --persistent        # persist browser profile to disk
+playwright-cli open --profile=<path>    # custom profile directory
+```
+
+## Snapshots
+
+After each command, playwright-cli provides a snapshot of the current browser state with element refs (e.g. `e3`, `e15`) that can be used with `click`, `fill`, and other commands.
+
+```bash
+> playwright-cli -s=proxy goto https://example.is
+### Page
+- Page URL: https://example.is/
+- Page Title: Example
+### Snapshot
+[Snapshot](.playwright-cli/page-2026-02-26T10-00-00-000Z.yml)
+```
+
+## Troubleshooting
+
+- **"proxy is not running"** -- start the proxy first with `mise run dev -- --blocklist examples/is.rules`
+- **HTTPS timeouts** -- the proxy config (`playwright-cli-proxy.json`) sets `ignoreHTTPSErrors: true`. Verify the config file exists and is passed via `--config`.
+- **Navigation timeout** -- the target site may be down. Try `curl --max-time 5 https://example.is` to verify.
+- **Cloudflare challenge** -- some sites block headless browsers. The page title will be "Just a moment...". Try a different site.
+- **No element replacements** -- the page may use zstd compression (not yet supported) or the selectors may no longer match the current site markup.
+- **Stale sessions** -- if browsers become unresponsive, run `playwright-cli kill-all`.
diff --git a/.gitignore b/.gitignore
index af10501..124537c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 ublproxy
 *.test
 mise.local.toml
+.playwright-cli/
 tmp/
diff --git a/AGENTS.md b/AGENTS.md
index 6bd0a6a..09945c0 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,8 +2,9 @@
 
 ## Temporary files
 
-Temporary files must be stored in `tmp/`. This directory is gitignored. Never write temporary files to the project root or other directories.
+Temporary files (screenshots, traces, recordings, etc.) must be stored in `tmp/`. This directory is gitignored. Never write temporary files to the project root or other directories.
 
 ```bash
 curl -s --proxy http://127.0.0.1:8080 -k https://example.com > tmp/response.html
+playwright-cli -s=proxy screenshot --filename=tmp/screenshot.png
 ```
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3cad063..cdb72ee 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -127,6 +127,37 @@ mise run test
 go test ./...
 ```
 
+### Browser testing
+
+For visual verification of proxy behavior in a real browser, use `playwright-cli` (installed via mise):
+
+```sh
+# Terminal 1: start the proxy
+mise run dev -- --blocklist examples/is.rules
+
+# Terminal 2: open a browser through the proxy
+mise run browser -- https://example.is
+
+# Terminal 2: open a browser without the proxy (for comparison)
+mise run browser-no-proxy -- https://example.is
+```
+
+The proxy session uses `playwright-cli-proxy.json` which configures the proxy address and ignores HTTPS certificate errors from the MITM CA.
+
+Interact with sessions using `playwright-cli -s=proxy <command>` or `playwright-cli -s=no-proxy <command>`:
+
+```sh
+# Take comparison screenshots
+playwright-cli -s=proxy screenshot --filename=tmp/with-proxy.png
+playwright-cli -s=no-proxy screenshot --filename=tmp/without-proxy.png
+
+# Check for element replacements in the DOM
+playwright-cli -s=proxy eval "document.documentElement.innerHTML.match(/<!-- ublproxy: replaced [^>]+ -->/g)"
+
+# Close sessions when done
+playwright-cli close-all
+```
+
 For verbose output:
 
 ```sh
diff --git a/DECISIONS.md b/DECISIONS.md
index 67387d3..60102e8 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -16,4 +16,6 @@
 - 2026-02-26 m+git@andri.dk — Added `golang.org/x/net` (zero transitive runtime deps, Go team maintained) for HTML tokenization in element replacement. Selectors are classified at cache time into simple (single-element matchable) and complex (needs CSS fallback).
 - 2026-02-26 m+git@andri.dk — Blocked CONNECT requests return 403 Forbidden instead of 204 No Content. Browsers hang on 204 because they expect a tunnel; 403 makes them fail fast.
 - 2026-02-26 m+git@andri.dk — Removed Playwright from the project. Playwright's screenshot and snapshot commands wait for `document.fonts.ready`, which never resolves when the MITM proxy blocks ad-network domains that serve fonts. curl is a better fit for proxy testing.
+- 2026-02-26 m+git@andri.dk — Re-added playwright-cli for browser testing. Previous HTTPS timeouts were caused by environment variable configuration not being picked up. Fixed by using a declarative config file (`playwright-cli-proxy.json`) with `contextOptions.ignoreHTTPSErrors` and `contextOptions.proxy` instead of env vars.
 - 2026-02-26 m+git@andri.dk — Elements that load external resources (script, iframe, object, embed) are stripped during HTML rewriting when their resource URL resolves to a blocked address. Defense-in-depth alongside network-level blocking: stripping the element from the DOM prevents the browser from attempting the load. `srcBlockableTags` maps tag name to URL attribute (`src` for most, `data` for object). Void elements (embed) skip the `skipUntilClose` step. Relative and protocol-relative URLs are resolved against the page origin. Inline scripts (no `src`) are not affected.
+- 2026-02-26 m+git@andri.dk — Disabled HTTP/2 on upstream transport (`TLSNextProto` set to empty map). Go's default `http.Transport` negotiates HTTP/2 via ALPN, which caused indefinite hangs on certain Cloudflare-hosted domains (`s3-bm-adtech.berlingskemedia.net`, `s3-common-jscdn.berlingskemedia.net`). The proxy serializes requests over HTTP/1.1 on the client side, so HTTP/2 multiplexing provides no benefit. Forcing HTTP/1.1 upstream eliminates the hang and matches what most MITM proxies do.
diff --git a/mise.toml b/mise.toml
index d5d7c93..8605b38 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,5 +1,6 @@
 [tools]
 go = "1.25"
+"npm:@playwright/cli" = "latest"
 
 [task_config]
 includes = ["scripts"]
diff --git a/playwright-cli-proxy.json b/playwright-cli-proxy.json
new file mode 100644
index 0000000..2c7218c
--- /dev/null
+++ b/playwright-cli-proxy.json
@@ -0,0 +1,10 @@
+{
+  "browser": {
+    "contextOptions": {
+      "ignoreHTTPSErrors": true,
+      "proxy": {
+        "server": "http://127.0.0.1:8080"
+      }
+    }
+  }
+}
diff --git a/proxy.go b/proxy.go
index b6bd489..36bd667 100644
--- a/proxy.go
+++ b/proxy.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"crypto/tls"
 	"net/http"
 
 	"ublproxy/pkg/blocklist"
@@ -18,7 +19,11 @@ func newProxyHandler(certs *certCache, caCertPEM []byte, rules *blocklist.RuleSe
 		certs:     certs,
 		caCertPEM: caCertPEM,
 		rules:     rules,
-		transport: &http.Transport{},
+		// Force HTTP/1.1 upstream. Go's default HTTP/2 support causes hangs
+		// with certain Cloudflare hosts in a MITM proxy scenario.
+		transport: &http.Transport{
+			TLSNextProto: make(map[string]func(authority string, c *tls.Conn) http.RoundTripper),
+		},
 	}
 }
 
diff --git a/scripts/browser b/scripts/browser
new file mode 100755
index 0000000..5e46cba
--- /dev/null
+++ b/scripts/browser
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+#MISE description="Open a browser routed through the proxy"
+set -euo pipefail
+
+if ! curl -s --max-time 2 --proxy http://127.0.0.1:8080 http://example.com -o /dev/null 2>/dev/null; then
+  echo "Error: proxy is not running on 127.0.0.1:8080"
+  echo "Start it first: mise run dev -- --blocklist examples/is.rules"
+  exit 1
+fi
+
+playwright-cli --config=playwright-cli-proxy.json -s=proxy open "$@"
diff --git a/scripts/browser-no-proxy b/scripts/browser-no-proxy
new file mode 100755
index 0000000..99e2964
--- /dev/null
+++ b/scripts/browser-no-proxy
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Open a browser without the proxy (for comparison)"
+set -euo pipefail
+
+playwright-cli -s=no-proxy open "$@"