diff --git a/deploy/Caddyfile b/deploy/Caddyfile.snippet
similarity index 82%
rename from deploy/Caddyfile
rename to deploy/Caddyfile.snippet
index 9f08cbe..a294138 100644
--- a/deploy/Caddyfile
+++ b/deploy/Caddyfile.snippet
@@ -1,8 +1,5 @@
-# deploy.sh copies this file over /etc/caddy/Caddyfile wholesale, so a vhost
-# added straight to the live file is silently lost on the next deploy. Other
-# sites on this box own a file in conf.d instead and install it themselves.
-# A glob that matches nothing is not an error, so this stays valid alone.
-import /etc/caddy/conf.d/*.caddy
+# Installed by deploy.sh to /etc/caddy/conf.d/lichen.caddy.
+# Never copy this into /etc/caddy/Caddyfile directly.
 
 lichen.wiki {
 	tls {
@@ -25,7 +22,7 @@ lichen.wiki {
 
 		header Cache-Control "public, max-age=31536000, immutable"
 	}
-	
+
 	# HTML microcache
 	handle {
 		header Cache-Control "public, max-age=2"
diff --git a/deploy/caddy.service b/deploy/caddy.service
deleted file mode 100644
index 09fa872..0000000
--- a/deploy/caddy.service
+++ /dev/null
@@ -1,14 +0,0 @@
-[Unit]
-Description=Caddy web server
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/caddy run --config /etc/caddy/Caddyfile --envfile /etc/lichen/env
-ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
-Restart=on-failure
-RestartSec=5
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target
diff --git a/deploy/deploy.sh b/deploy/deploy.sh
index 4822c9f..c8555ff 100755
--- a/deploy/deploy.sh
+++ b/deploy/deploy.sh
@@ -9,7 +9,7 @@ for arg in "$@"; do
   esac
 done
 
-VPS="lichen"
+VPS="${VPS:-ovh-vps}"
 
 if [ "$TARGET" = "staging" ]; then
   APP_DIR="/opt/lichen-staging"
@@ -62,9 +62,8 @@ ssh "$VPS" "
 
 log "==> Updating config files"
 ssh "$VPS" "
-  sudo mkdir -p /etc/caddy
-  sudo cp ${APP_DIR}/deploy/Caddyfile /etc/caddy/Caddyfile
-  sudo cp ${APP_DIR}/deploy/caddy.service /etc/systemd/system/
+  sudo mkdir -p /etc/caddy/conf.d
+  sudo cp ${APP_DIR}/deploy/Caddyfile.snippet /etc/caddy/conf.d/lichen.caddy
   sudo cp ${APP_DIR}/deploy/lichen-appview.service /etc/systemd/system/
   sudo cp ${APP_DIR}/deploy/lichen-firehose.service /etc/systemd/system/
   sudo cp ${APP_DIR}/deploy/lichen-appview-staging.service /etc/systemd/system/
@@ -75,11 +74,12 @@ ssh "$VPS" "
   sudo systemctl daemon-reload
 "
 
+# Only reload Caddy — never restart it or touch its base config.
 log "==> Restarting services"
 if [ "$TARGET" = "staging" ]; then
   ssh "$VPS" "sudo systemctl reload caddy && sudo systemctl restart ${APPVIEW_UNIT} ${FIREHOSE_UNIT}"
 else
-  ssh "$VPS" "sudo systemctl restart caddy ${APPVIEW_UNIT} ${FIREHOSE_UNIT} litestream"
+  ssh "$VPS" "sudo systemctl reload caddy && sudo systemctl restart ${APPVIEW_UNIT} ${FIREHOSE_UNIT} litestream"
 fi
 
 log "==> Health check (waiting 3s for startup)"
diff --git a/deploy/setup.sh b/deploy/setup.sh
index 6fefc41..8166d97 100755
--- a/deploy/setup.sh
+++ b/deploy/setup.sh
@@ -58,7 +58,6 @@ OAUTH_PRIVATE_KEY_PATH=
 RELAY_URL=wss://bsky.network
 DB_PATH=/var/lib/lichen/lichen.db
 REGISTRY_DB_PATH=/var/lib/lichen/registry.db
-CLOUDFLARE_API_TOKEN=
 LITESTREAM_R2_ACCOUNT_ID=
 LITESTREAM_R2_ACCESS_KEY_ID=
 LITESTREAM_R2_SECRET_ACCESS_KEY=
@@ -95,20 +94,22 @@ EOF
   chmod 600 "$STAGING_ENV_FILE"
 fi
 
-echo "==> Installing config files"
-mkdir -p /etc/caddy
-cp "$SCRIPT_DIR/Caddyfile" /etc/caddy/Caddyfile
-cp "$SCRIPT_DIR/caddy.service" /etc/systemd/system/
+echo "==> Installing lichen's own config files"
 cp "$SCRIPT_DIR/lichen-appview.service" /etc/systemd/system/
 cp "$SCRIPT_DIR/lichen-firehose.service" /etc/systemd/system/
 cp "$SCRIPT_DIR/lichen-appview-staging.service" /etc/systemd/system/
 cp "$SCRIPT_DIR/lichen-firehose-staging.service" /etc/systemd/system/
 cp "$SCRIPT_DIR/litestream.yml" /etc/litestream.yml
+mkdir -p /etc/caddy/conf.d
+cp "$SCRIPT_DIR/Caddyfile.snippet" /etc/caddy/conf.d/lichen.caddy
 systemctl daemon-reload
 
+echo ""
+echo "==> This script does not install Caddy itself — set that up separately."
 echo ""
 echo "==> Setup complete!"
-echo "  1. Edit /etc/lichen/env — set CLOUDFLARE_API_TOKEN, OAUTH_PRIVATE_KEY_PATH, R2 keys"
+echo "  1. Edit /etc/lichen/env — set OAUTH_PRIVATE_KEY_PATH, R2 keys"
+echo "     (CLOUDFLARE_API_TOKEN goes in /etc/caddy/cloudflare.env)"
 echo "  2. Register a separate ATProto OAuth client for https://staging.lichen.wiki"
 echo "  3. Deploy code: ./deploy/deploy.sh           (prod)"
 echo "                  ./deploy/deploy.sh --target=staging"
diff --git a/deploy/staging.sh b/deploy/staging.sh
index b96f0e3..6bbd971 100755
--- a/deploy/staging.sh
+++ b/deploy/staging.sh
@@ -5,7 +5,7 @@
 #   ./deploy/staging.sh status  # show unit + URL status
 set -euo pipefail
 
-VPS="lichen"
+VPS="${VPS:-ovh-vps}"
 ACTION="${1:-}"
 
 case "$ACTION" in