Index: src/assets/js/embed-player.js
===================================================================
--- src/assets/js/embed-player.js	(revision 5f47671b8c8beb7dbe7dcbfc46d88c69727697ba)
+++ src/assets/js/embed-player.js	(revision 16b0c005569dfa6bbec9512f9815fd7100ebe95a)
@@ -101,5 +101,7 @@
       };
       loadScript('https://open.spotify.com/embed/iframe-api/v1').catch(reject);
-      setTimeout(() => reject(new Error('Spotify API timeout')), API_TIMEOUT);
+      // Korter dan API_TIMEOUT: Spotify's bundle initialiseert snel óf helemaal
+      // niet (CDN 503 / origin-gating). Niet 8s wachten vóór de iframe-fallback.
+      setTimeout(() => reject(new Error('Spotify API timeout')), 4000);
     });
     return scripts.sp;
Index: src/server.js
===================================================================
--- src/server.js	(revision 5f47671b8c8beb7dbe7dcbfc46d88c69727697ba)
+++ src/server.js	(revision 16b0c005569dfa6bbec9512f9815fd7100ebe95a)
@@ -93,5 +93,6 @@
         "https://s.ytimg.com",       // YouTube player-assets
         "https://w.soundcloud.com",  // SoundCloud Widget API (api.js)
-        "https://open.spotify.com",  // Spotify iFrame API
+        "https://open.spotify.com",  // Spotify iFrame API (loader)
+        "https://*.spotifycdn.com",  // Spotify iFrame API (echte bundle: embed-cdn.spotifycdn.com)
       ],
       // Helmet's default zet script-src-attr op 'none', wat ALLE inline event-
@@ -103,5 +104,5 @@
       styleSrc: ["'self'", "'unsafe-inline'"],
       imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "wss:", "ws:"],
+      connectSrc: ["'self'", "wss:", "ws:", "https://*.spotifycdn.com", "https://*.scdn.co"],
       // blob: is required for the audio player — it fetch()es track bytes and
       // plays from a blob: object URL (Spotify-style). Without blob: here the
Index: src/views/shell.ejs
===================================================================
--- src/views/shell.ejs	(revision 5f47671b8c8beb7dbe7dcbfc46d88c69727697ba)
+++ src/views/shell.ejs	(revision 16b0c005569dfa6bbec9512f9815fd7100ebe95a)
@@ -303,5 +303,5 @@
 <!-- Eigen custom media-embeds (YouTube/SoundCloud/Spotify) via de echte
      player-API's + gedeelde mutual-exclusion registry met de site-speler. -->
-<script src="/assets/js/embed-player.js?v=4" defer></script>
+<script src="/assets/js/embed-player.js?v=5" defer></script>
 <% if (site && site.enable_audio_player && audioTracks && audioTracks.length > 0) { %>
   <script>window.PCMS_SITE_TRACKS = <%- JSON.stringify(audioTracks) %>;</script>