diff --git a/app/templates/board.html b/app/templates/board.html
index cc7fc93..52d2246 100644
--- a/app/templates/board.html
+++ b/app/templates/board.html
@@ -244,7 +244,11 @@
       title: '', status: 'todo',
       create() {
         if (!this.title.trim()) return;
-        fetch(`/api/issues/${owner}/${repo}?title=${encodeURIComponent(this.title)}&labels=${this.status}`, { method: 'POST' })
+        const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+        fetch(`/api/issues/${owner}/${repo}?title=${encodeURIComponent(this.title)}&labels=${this.status}`, {
+          method: 'POST',
+          headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+        })
           .then(r => r.json())
           .then(data => {
             this.title = '';
@@ -277,7 +281,11 @@
           onEnd: function(evt) {
             const cardId = evt.item.dataset.cardId;
             const toStatus = evt.to.dataset.status;
-            fetch(`/api/move?owner=${owner}&repo=${repo}&issue_id=${cardId}&column=${toStatus}`, { method: 'POST' })
+            const csrf = document.cookie.match(/csrf_token=([^;]+)/);
+            fetch(`/api/move?owner=${owner}&repo=${repo}&issue_id=${cardId}&column=${toStatus}`, {
+              method: 'POST',
+              headers: { 'X-CSRF-Token': csrf ? csrf[1] : '' }
+            })
               .then(() => {
                 // ponytail: refresh current view after move
                 const activeTab = document.querySelector('.view-tab.active');
diff --git a/app/templates/card_detail.html b/app/templates/card_detail.html
index 03293ec..7b237a9 100644
--- a/app/templates/card_detail.html
+++ b/app/templates/card_detail.html
@@ -99,6 +99,12 @@
 </div>
 
 <script>
+  // ponytail: CSRF helper
+  function getCsrf() {
+    const m = document.cookie.match(/csrf_token=([^;]+)/);
+    return m ? m[1] : '';
+  }
+
   function cardDetail() {
     return {
       updateField(field, value) {
@@ -109,18 +115,27 @@
         console.log('Toggle status');
       },
       toggleChecklistItem(id, checked) {
-        fetch(`/api/checklist-items/${id}?checked=${checked}`, { method: 'PATCH' });
+        fetch(`/api/checklist-items/${id}?checked=${checked}`, {
+          method: 'PATCH',
+          headers: { 'X-CSRF-Token': getCsrf() }
+        });
       },
       addChecklistItem(clId) {
         const content = prompt('Item name:');
         if (content) {
-          fetch(`/api/checklist-items/${owner}/${repo}/${issue_id}/${clId}?content=${encodeURIComponent(content)}`, { method: 'POST' })
+          fetch(`/api/checklist-items/${owner}/${repo}/${issue_id}/${clId}?content=${encodeURIComponent(content)}`, {
+            method: 'POST',
+            headers: { 'X-CSRF-Token': getCsrf() }
+          })
             .then(() => htmx.ajax('GET', `/api/issues/${owner}/${repo}/${issue_id}?format=html`, { target: '#card-modal-content', swap: 'innerHTML' }));
         }
       },
       addChecklist() {
         const title = prompt('Checklist name:') || 'Checklist';
-        fetch(`/api/checklists/${owner}/${repo}/${issue_id}?title=${encodeURIComponent(title)}`, { method: 'POST' })
+        fetch(`/api/checklists/${owner}/${repo}/${issue_id}?title=${encodeURIComponent(title)}`, {
+          method: 'POST',
+          headers: { 'X-CSRF-Token': getCsrf() }
+        })
           .then(() => htmx.ajax('GET', `/api/issues/${owner}/${repo}/${issue_id}?format=html`, { target: '#card-modal-content', swap: 'innerHTML' }));
       },
       addComment(body) {