diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 8d9676ac..67b8e747 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -7,6 +7,7 @@ Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi2#dns_1984hosting
 Options:
  One984HOSTING_Username Username
  One984HOSTING_Password Password
+ One984HOSTING_OTP OTP/2FA code. Optional. One-shot only, never stored, so unusable for unattended renewal of 2FA accounts.
 Issues: github.com/acmesh-official/acme.sh/issues/2851
 Author: Adrian Fedoreanu
 '
@@ -124,9 +125,13 @@ _1984hosting_login() {
   _debug "Login to 1984Hosting as user $One984HOSTING_Username."
   username=$(printf '%s' "$One984HOSTING_Username" | _url_encode)
   password=$(printf '%s' "$One984HOSTING_Password" | _url_encode)
-  url="https://1984.hosting/api/auth/"
+  # OTP is time-based; only useful for a single interactive run, never persisted.
+  One984HOSTING_OTP="${One984HOSTING_OTP:-}"
+  otpkey=$(printf '%s' "$One984HOSTING_OTP" | _url_encode)
 
-  _get "https://1984.hosting/accounts/login/" | grep "csrfmiddlewaretoken"
+  # Fetch the login page to obtain CSRF and session cookies.
+  # Note: _get sets the global 'url', so assign the auth URL afterwards.
+  _get "https://1984.hosting/accounts/login/" >/dev/null
   csrftoken="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _egrep_o 'csrftoken=[^;]*;' | tr -d ';')"
   sessionid="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _egrep_o 'cookie1984nammnamm=[^;]*;' | tr -d ';')"
 
@@ -140,7 +145,8 @@ _1984hosting_login() {
   csrf_header=$(echo "$csrftoken" | sed 's/csrftoken=//' | _head_n 1)
   export _H3="X-CSRFToken: $csrf_header"
 
-  response="$(_post "username=$username&password=$password&otpkey=" $url)"
+  url="https://1984.hosting/api/auth/"
+  response="$(_post "username=$username&password=$password&otpkey=$otpkey" "$url")"
   response="$(echo "$response" | _normalizeJson)"
   _debug2 response "$response"
 
@@ -225,9 +231,15 @@ _get_root() {
 
 # Usage: _get_zone_id url domain.com
 # Returns zone id for domain.com
+# Memoized per-domain so add/rm don't re-fetch the same zone list within a run.
+# Keyed on domain (not url) since the url is always the domains listing.
 _get_zone_id() {
   url=$1
   domain=$2
+  if [ "$_zone_id_for" = "$domain" ] && [ -n "$_zone_id" ]; then
+    _debug2 _zone_id "$_zone_id (cached)"
+    return 0
+  fi
   _htmlget "$url" "$domain"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+' | _head_n 1)"
   _debug2 _zone_id "$_zone_id"
@@ -235,6 +247,7 @@ _get_zone_id() {
     _err "Error getting _zone_id for $2."
     return 1
   fi
+  _zone_id_for="$domain"
   return 0
 }
 
@@ -257,9 +270,8 @@ _htmlget() {
 
 # Add extra headers to request
 _authpost() {
-  url="https://1984.hosting/domains"
-  _get_zone_id "$url" "$_domain"
-  csrf_header="$(echo "$One984HOSTING_CSRFTOKEN_COOKIE" | _egrep_o "=[^=][0-9a-zA-Z]*" | tr -d "=")"
+  _get_zone_id "https://1984.hosting/domains" "$_domain"
+  csrf_header="$(echo "$One984HOSTING_CSRFTOKEN_COOKIE" | sed 's/csrftoken=//' | _head_n 1)"
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE; $One984HOSTING_SESSIONID_COOKIE"
   export _H2="Referer: https://1984.hosting/domains/$_zone_id"
   export _H3="X-CSRFToken: $csrf_header"