diff --git a/frontend/src/utils/api.js b/frontend/src/utils/api.js
index 9e745df..0f6371e 100644
--- a/frontend/src/utils/api.js
+++ b/frontend/src/utils/api.js
@@ -8,12 +8,19 @@ export const FILE_BASE = import.meta.env.VITE_API_BASE
 // P5: CSRF token kept in memory only (not localStorage - not sensitive, but avoids stale tokens)
 let csrfToken = null;
 
+// Helper: Read CSRF token from cookie (fallback after page reload)
+function getCSRFTokenFromCookie() {
+  const match = document.cookie.match(/workflow_csrf=([^;]+)/);
+  return match ? match[1] : null;
+}
+
 export function setCSRFToken(token) {
   csrfToken = token;
 }
 
 export function getCSRFToken() {
-  return csrfToken;
+  // Return memory token, or fallback to cookie (after page reload)
+  return csrfToken || getCSRFTokenFromCookie();
 }
 
 // P5: Auth relies on HttpOnly cookie only - no token in localStorage