diff --git a/app/__init__.py b/app/__init__.py
index 3957ddd..ee8222e 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -25,6 +25,11 @@ def create_app(config_name='default'):
     login_manager.login_message      = 'Please log in to access this page.'
     login_manager.login_message_category = 'info'
 
+    # Register csrf_token() as an app-wide Jinja2 global so templates that
+    # render manual forms (no WTForms object) can still inject the CSRF token.
+    from flask_wtf.csrf import generate_csrf
+    app.jinja_env.globals['csrf_token'] = generate_csrf
+
     os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
 
     from app.routes import auth, dashboard, inspections, templates, reports, facilities
diff --git a/app/templates/inspections/execute.html b/app/templates/inspections/execute.html
index 64abef6..5625d39 100644
--- a/app/templates/inspections/execute.html
+++ b/app/templates/inspections/execute.html
@@ -13,7 +13,6 @@
 {% endblock %}
 {% block content %}
 <form method="post" enctype="multipart/form-data" id="inspectionForm">
-  {{ csrf_token() | safe }}
   <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
 
   {# Sticky toolbar #}