diff --git a/src/Http/Handlers/GetHomePage.php b/src/Http/Handlers/GetHomePage.php
index 82cd9be..32275ef 100644
--- a/src/Http/Handlers/GetHomePage.php
+++ b/src/Http/Handlers/GetHomePage.php
@@ -12,30 +12,12 @@ final class GetHomePage
     /** @param array<string, string> $params */
     public function handle(Request $request, array $params): Response
     {
-        $body = <<<'HTML'
-<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="utf-8">
-    <title>BattleForge</title>
-    <link rel="stylesheet" href="/assets/styles.css">
-    <meta name="csrf-token" content="{{ csrf }}">
-</head>
-<body>
-    <h1>BattleForge</h1>
-    <p><a href="/scenarios/new/edit/team">New scenario</a></p>
-    <h2>Recent scenarios</h2>
-    <div id="recent"><p class="bf-empty">No saved scenarios yet.</p></div>
-    <script type="module" src="/js/storage.js"></script>
-</body>
-</html>
-HTML;
+        $csrf = $request->cookies['__csrf'] ?? '';
 
-        // The CSRF token placeholder is filled by the front controller (Task 16)
-        // before the body is sent. The handler does not see the cookie or the
-        // secret; it just receives a pre-issued token from the front controller.
-        $token = $request->cookies['__csrf'] ?? '';
-        $body = str_replace('{{ csrf }}', htmlspecialchars($token, ENT_QUOTES, 'UTF-8'), $body);
+        ob_start();
+        require_once __DIR__ . '/../../Views/layout.php';
+        require __DIR__ . '/../../Views/home.php';
+        $body = (string) ob_get_clean();
 
         return Response::html(200, $body);
     }
