diff --git a/server/server.js b/server/server.js
index 5d4da4f..c2ea82f 100644
--- a/server/server.js
+++ b/server/server.js
@@ -24,7 +24,7 @@ import { serveStatic }  from 'hono/bun';
 import { logger }       from 'hono/logger';
 import { spawnSync }    from 'node:child_process';
 import { createServer } from 'node:http';
-import { readFileSync }  from 'node:fs';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { createHash }    from 'node:crypto';
 import { initDb, upsertUser, recordVideoAccess, getUserData } from './db.js';
 
@@ -51,10 +51,19 @@ const YTDLP       = process.env.YTDLP_PATH  || 'yt-dlp';
 // ----------------------------------------------------------------------------
 function computeBuildTag() {
   try {
+    // Hash EVERY served frontend file (recursively, in sorted order), not a
+    // hand-picked subset — a change to any shell file (e.g. sw-update.js or
+    // opfs.js) must produce a new tag, or clients keep their old SW cache
+    // and never receive the change.
     const hash = createHash('sha256');
-    for (const file of ['app.js', 'sw.js', 'index.html', 'styles.css']) {
-      hash.update(readFileSync(`./public/${file}`));
-    }
+    const walk = (dir) => {
+      for (const name of readdirSync(dir).sort()) {
+        const path = `${dir}/${name}`;
+        if (statSync(path).isDirectory()) walk(path);
+        else { hash.update(path); hash.update(readFileSync(path)); }
+      }
+    };
+    walk('./public');
     return hash.digest('hex').slice(0, 12);
   } catch {
     // Frontend files not readable (e.g. unit tests run outside ./public) —