diff --git a/run.sh b/run.sh
index aead454..9362c2f 100755
--- a/run.sh
+++ b/run.sh
@@ -3,7 +3,10 @@
 cd "$(dirname "$0")" || exit 1
 [ -x .venv/bin/python ] || { echo "no .venv — run: uv venv .venv && uv pip install --python .venv/bin/python -r requirements.txt"; exit 1; }
 pkill -f "uvicorn .*app:app" 2>/dev/null; sleep 1
+# graceful shutdown waits for in-flight /stream requests; force-kill anything
+# still holding the port, or the old process outlives the restart
+pkill -9 -f "uvicorn .*app:app" 2>/dev/null
 # ANIWEB_SECURE=1: session cookie is Secure — only usable via the HTTPS
 # proxy (plain http://<this machine>:8321 can no longer hold a session).
-ANIWEB_SECURE=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 > server.log 2>&1 &
+ANIWEB_SECURE=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 --timeout-graceful-shutdown 3 > server.log 2>&1 &
 echo "ani-web on http://localhost:8321 (pid $!) — use the HTTPS proxy to log in"