diff --git a/public/embed.js b/public/embed.js
index aedeb8e..73beb8b 100644
--- a/public/embed.js
+++ b/public/embed.js
@@ -28,7 +28,7 @@
     var box = document.createElement('div');
     box.setAttribute('role', 'note');
     box.style.cssText = 'display:inline-flex;align-items:center;gap:10px;padding:10px 14px;border-radius:14px;background:linear-gradient(135deg,#1a0f3d,#2b1a63);color:#f1eefb;font:600 14px/1.2 system-ui,-apple-system,"Segoe UI",sans-serif;box-shadow:0 8px 30px rgba(130,71,229,.45),0 0 0 1px rgba(255,255,255,.08);letter-spacing:.02em';
-    box.innerHTML = '<span style="width:22px;height:22px;border-radius:50%;background:radial-gradient(circle at 35% 35%,#c9a4ff,#8247e5 60%,#4b2a8c);box-shadow:0 0 14px rgba(130,71,229,.9);flex:none"></span><span>PolHunter code <b style="font-family:ui-monospace,Menlo,monospace;font-size:16px;letter-spacing:.14em;color:#f3be43">' + code + '</b></span>';
+    box.innerHTML = '<img src="' + API + '/img/coin-sm.png" alt="" width="30" height="30" style="width:30px;height:30px;object-fit:contain;flex:none;filter:drop-shadow(0 0 8px rgba(130,71,229,.85))"><span>PolHunter code <b style="font-family:ui-monospace,Menlo,monospace;font-size:16px;letter-spacing:.14em;color:#f3be43">' + code + '</b></span>';
     el.appendChild(box);
   }
   var tries = 0, pending = null, done = false;
diff --git a/public/img/coin-sm.png b/public/img/coin-sm.png
new file mode 100644
index 0000000..12d6a09
Binary files /dev/null and b/public/img/coin-sm.png differ
diff --git a/public/img/coin.png b/public/img/coin.png
new file mode 100644
index 0000000..0359005
Binary files /dev/null and b/public/img/coin.png differ
diff --git a/server.js b/server.js
index b9ce9e6..c68cd89 100644
--- a/server.js
+++ b/server.js
@@ -92,6 +92,8 @@ const server = http.createServer(async (req, res) => {
       return json(res, r.error ? 403 : 200, r, cors);
     }
     if (p === '/embed.js') return sendFile(res, path.join(PUBLIC_DIR, 'embed.js'), { 'Cache-Control': 'public, max-age=300', 'Access-Control-Allow-Origin': '*' });
+    // the coin on the code pill, fetched by mission-site visitors who hold no curtain pass
+    if (p === '/img/coin-sm.png' || p === '/img/coin.png') return sendFile(res, path.join(PUBLIC_DIR, p.slice(1)), { 'Cache-Control': 'public, max-age=86400' });
 
     if (curtained(req, res, u)) return;