diff --git a/lib/common.sh b/lib/common.sh
index 9a2777b..67265d7 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -512,10 +512,20 @@ CADDY_BLOCK
         echo "  ✓ Configuration added to Caddyfile"
         echo "  Reloading Caddy configuration..."
         docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+        # The template Caddyfile ships with "admin off" (security hardening —
+        # no local API attack surface), so `caddy reload` never works here;
+        # it depends on that same admin endpoint. Try it anyway in case a
+        # box has admin enabled, but fall back to a full container restart
+        # (brief availability gap for everything Caddy fronts, but reliable
+        # regardless of the admin setting) rather than leaving the change
+        # sitting unapplied on disk.
         if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
             echo "  ✓ $SERVICE_NAME is now accessible at: https://$SERVICE_DOMAIN"
+        elif docker restart caddy &>/dev/null; then
+            echo "  ✓ Caddy restarted to apply changes (reload API is disabled by default)"
+            echo "  ✓ $SERVICE_NAME should be accessible at: https://$SERVICE_DOMAIN"
         else
-            echo "  ⚠ Failed to reload Caddy. Check: docker logs caddy"
+            echo "  ⚠ Failed to reload or restart Caddy. Check: docker logs caddy"
             echo "  You can restore from backup: $BACKUP_FILE"
         fi
 
@@ -533,7 +543,7 @@ CADDY_BLOCK
         echo "    scp $SNIPPET_FILE caddy-host:~/caddy-snippets/"
         echo "    # then on the Caddy machine:"
         echo "    cat ~/caddy-snippets/${DEFAULT_SUBDOMAIN}.caddy >> /path/to/Caddyfile"
-        echo "    docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+        echo "    docker restart caddy   # reload API is disabled by default; a restart is what applies it"
         echo ""
         echo "  Or rsync all snippets at once:"
         echo "    rsync -av $SNIPPET_DIR/ caddy-host:~/caddy-snippets/"
diff --git a/services/asterisk-do.sh b/services/asterisk-do.sh
index ff0e6d4..c0c0837 100755
--- a/services/asterisk-do.sh
+++ b/services/asterisk-do.sh
@@ -145,11 +145,17 @@ CBLOCK
                 printf '%s\n' "$_site_block" >> "$_caddyfile"
                 log_success "Added $_domain to Caddyfile"
                 docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+                # The template Caddyfile ships with "admin off", so `caddy
+                # reload` (which needs that same admin API) never actually
+                # works here. Try it anyway, fall back to a restart.
                 if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
                     log_success "$_name accessible at: https://$_domain"
+                elif docker restart caddy &>/dev/null; then
+                    log_success "Caddy restarted to apply changes (reload API is disabled by default)"
+                    log_success "$_name should be accessible at: https://$_domain"
                 else
-                    log_warning "Reload failed — check: docker logs caddy"
-                    log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+                    log_warning "Reload/restart failed — check: docker logs caddy"
+                    log_info "Manual fix: docker restart caddy"
                 fi
             else
                 local _snippet_dir="$DOCKER_DIR/caddy-snippets"
@@ -721,11 +727,18 @@ CADDY_BLOCK
                     printf '%s\n' "$_SITE_BLOCK" >> "$_CADDYFILE"
                     log_success "Added ${DOMAIN_NAME} to Caddyfile (backup: $(basename "$_CADDY_BACKUP"))"
                     docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+                    # The template Caddyfile ships with "admin off", so
+                    # `caddy reload` (which needs that same admin API) never
+                    # actually works here. Try it anyway, fall back to a
+                    # restart — confirmed necessary on a real deployment.
                     if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
                         log_success "Web admin accessible at: https://${DOMAIN_NAME}"
+                    elif docker restart caddy &>/dev/null; then
+                        log_success "Caddy restarted to apply changes (reload API is disabled by default)"
+                        log_success "Web admin should be accessible at: https://${DOMAIN_NAME}"
                     else
-                        log_warning "Reload failed — check: docker logs caddy"
-                        log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+                        log_warning "Reload/restart failed — check: docker logs caddy"
+                        log_info "Manual fix: docker restart caddy"
                     fi
                 fi
             else
diff --git a/services/asterisk.sh b/services/asterisk.sh
index 4e6514f..d683b98 100644
--- a/services/asterisk.sh
+++ b/services/asterisk.sh
@@ -143,11 +143,17 @@ CBLOCK
                 printf '%s\n' "$_site_block" >> "$_caddyfile"
                 log_success "Added $_domain to Caddyfile"
                 docker exec caddy caddy fmt --overwrite /etc/caddy/Caddyfile 2>/dev/null || true
+                # The template Caddyfile ships with "admin off", so `caddy
+                # reload` (which needs that same admin API) never actually
+                # works here. Try it anyway, fall back to a restart.
                 if docker exec caddy caddy reload --config /etc/caddy/Caddyfile 2>/dev/null; then
                     log_success "$_name accessible at: https://$_domain"
+                elif docker restart caddy &>/dev/null; then
+                    log_success "Caddy restarted to apply changes (reload API is disabled by default)"
+                    log_success "$_name should be accessible at: https://$_domain"
                 else
-                    log_warning "Reload failed — check: docker logs caddy"
-                    log_info "Manual reload: docker exec caddy caddy reload --config /etc/caddy/Caddyfile"
+                    log_warning "Reload/restart failed — check: docker logs caddy"
+                    log_info "Manual fix: docker restart caddy"
                 fi
             else
                 local _snippet_dir="$DOCKER_DIR/caddy-snippets"