diff --git a/deploy/COOLIFY.md b/deploy/COOLIFY.md
index a0b5244..6185d6c 100644
--- a/deploy/COOLIFY.md
+++ b/deploy/COOLIFY.md
@@ -10,6 +10,7 @@ Compose application managed by Coolify v4 on the `cool2026` instance.
   - server UUID: `locg048kwko4sws8wcggc0o4`
   - public IP: `172.235.183.140`
 - **Project:** `tools` (UUID `u8wooo0wwk4k8wcw48ww8oo8`)
+- **Application UUID:** `zsookwggwcss08wkkc4gookg`
 - **Source:** Forgejo, `https://forgejo-rko8sk40400wscowk4scko0w.altweb.me/spencer/raycer.git`, branch `main` (mirrored to GitLab `spencerflagg/raycer`)
 - **Compose file:** `/docker-compose.coolify.yaml` (the local-dev `docker-compose.yml` is for `raycer.test` only and is not used in prod)
 
@@ -22,11 +23,23 @@ Compose application managed by Coolify v4 on the `cool2026` instance.
 
 The frontend's nginx reverse-proxies `/api/*` to `http://backend:3000`.
 
-## Required env (set in Coolify dashboard)
+## Required env + per-service domain
 
-| Variable                    | Value                              | Notes |
-|-----------------------------|------------------------------------|-------|
-| `SERVICE_FQDN_FRONTEND_80`  | `https://raycer.altweb.me`         | Coolify magic var; injects Traefik labels for the frontend service. |
+The frontend's public domain is set on the application record itself (not as
+a normal env var) via the `docker_compose_domains` field. Coolify reads
+this and generates the Traefik labels for the `frontend` service:
+
+```json
+{ "frontend": { "name": "frontend", "domain": "https://raycer.altweb.me" } }
+```
+
+Coolify also auto-fills these env vars for the running containers (no
+manual entry required):
+
+| Variable                    | Value                              | Source |
+|-----------------------------|------------------------------------|--------|
+| `SERVICE_FQDN_FRONTEND`     | `https://raycer.altweb.me`         | derived from `docker_compose_domains.frontend.domain` |
+| `SERVICE_FQDN_FRONTEND_80`  | `https://raycer.altweb.me`         | declared in compose, overridden to literal value |
 
 The backend's `NODE_ENV`, `PORT`, and `DB_PATH` are set inside the compose file.
 
@@ -85,19 +98,26 @@ curl -X POST https://cool2026.altweb.me/api/v1/applications/public \
   }'
 ```
 
-After creation, the FQDN env var was set:
+After creation, the per-service domain was bound (this is the part that
+makes Coolify emit Traefik labels for the frontend service and request a
+Let's Encrypt cert for `raycer.altweb.me`):
 
 ```bash
-curl -X POST https://cool2026.altweb.me/api/v1/applications/<APP_UUID>/envs \
+APP_UUID=zsookwggwcss08wkkc4gookg
+curl -X PATCH https://cool2026.altweb.me/api/v1/applications/$APP_UUID \
   -H "Authorization: Bearer $TOKEN" \
   -H "Content-Type: application/json" \
-  -d '{"key":"SERVICE_FQDN_FRONTEND_80","value":"https://raycer.altweb.me","is_preview":false}'
+  -d '{
+    "docker_compose_domains": {
+      "frontend": { "name": "frontend", "domain": "https://raycer.altweb.me" }
+    }
+  }'
 ```
 
 Then deployed:
 
 ```bash
-curl -X POST "https://cool2026.altweb.me/api/v1/deploy?uuid=<APP_UUID>&force=false" \
+curl -X POST "https://cool2026.altweb.me/api/v1/deploy?uuid=$APP_UUID&force=true" \
   -H "Authorization: Bearer $TOKEN"
 ```