diff --git a/BuildConfig.sh b/BuildConfig.sh
index e47d349..0c342ec 100644
--- a/BuildConfig.sh
+++ b/BuildConfig.sh
@@ -5,7 +5,12 @@ FRONTEND_HOST="${FRONTEND_HOST:-http://localhost:80}"
 KC_CLIENT_ID="${KC_CLIENT_ID:-labdev}"
 KC_HOST="${KC_HOST:-https://login.hangman-lab.top}"
 KC_REALM="${KC_REALM:-Hangman-Lab}"
-DEBUG="${DEBUG:false}"
+# Note: ${DEBUG:-false} (correct default syntax). The old ${DEBUG:false}
+# produced an empty value when DEBUG was unset -> invalid config.json.
+DEBUG="${DEBUG:-false}"
+# DEBUG is emitted unquoted as a JSON boolean — guarantee it is exactly
+# true/false so config.json can never be invalid JSON.
+case "$DEBUG" in true|false) ;; *) DEBUG=false ;; esac
 rm -f /usr/share/nginx/html/config.js
 
 
diff --git a/webpack.config.js b/webpack.config.js
index 02eac43..122fe16 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -5,7 +5,11 @@ module.exports = {
     entry: './src/index.js',
     output: {
         path: path.resolve(__dirname, './dist'),
-        filename: 'bundle.js',
+        // Content-hashed filename: index.html (injected by HtmlWebpackPlugin,
+        // and not edge-cached) points at a unique URL each build, so a new
+        // deploy is picked up immediately — no stale CDN/browser bundle.
+        filename: '[name].[contenthash].js',
+        chunkFilename: '[name].[contenthash].js',
         publicPath: '/',
         clean: true,
     },