diff --git a/CLAUDE.md b/CLAUDE.md
index 77f5697..b501209 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -346,9 +346,23 @@ larger image beats a step that silently half-works.
 
 **`NG_ALLOWED_HOSTS` — a hard 400.** Angular checks `Host` and
 `X-Forwarded-Host` against an allowlist (SSRF). With one configured a miss is
-**400 `text/plain`**; only an *empty* list falls back to CSR. The env var is a
-comma list and is **unioned with** `angular.json`'s `security.allowedHosts`, not
-a replacement. `*.example.com` matches by suffix. Never set it to `*`.
+**400 `text/plain`** naming the host; only an *empty* list falls back to CSR.
+The env var is a comma list and is **unioned with** `angular.json`'s
+`security.allowedHosts`, not a replacement — `AngularAppEngine.getAllowedHosts`
+builds `new Set([...envList, ...manifest.allowedHosts])`, so `localhost` keeps
+working whatever is listed. `*.example.com` matches by suffix
+(`hostname.endsWith('.example.com')`, so it does **not** cover the bare apex).
+Never set it to `*`. Verified against `@angular/ssr`, not the docs.
+
+**Static files skip the check entirely**, which is how a half-broken deploy
+presents: `express.static` runs ahead of the Angular handler, so on a hostname
+that is not allowlisted `/sitemap.xml` and `/robots.txt` answer 200 while every
+SSR route 400s.
+
+The service answers on **two** hostnames — `actuo.onrender.com` and
+`actuo.programmersingh.dev` — so both are listed. The custom domain is listed
+exactly rather than as `*.programmersingh.dev`, which would admit every other
+subdomain of that zone.
 
 **Untrusted proxy headers — this is the silent one.** Angular deopts to CSR on
 any `x-forwarded-*` header it was not told to trust, returning a normal 200 that
@@ -361,9 +375,10 @@ Verify with `pnpm run verify:deploy <url>`, which tells the two apart. Reproduce
 the second locally:
 `curl -s -H 'X-Forwarded-For: 203.0.113.9' localhost:8080/ | grep ng-server-context`
 
-**`PUBLIC_ORIGIN` is a BUILD-time variable, not a runtime one** — a `Dockerfile`
-`ARG`. On Render it is declared as a normal env var only because Render turns
-those into build args; on any other host it needs an explicit `--build-arg`. The public pages are prerendered, so absolute
+**`PUBLIC_ORIGIN` is read twice, and changing it needs a REBUILD.** It is a
+`Dockerfile` `ARG` for the build half; on Render it is declared as a normal env
+var only because Render turns those into build args, and on any other host it
+needs an explicit `--build-arg`. The public pages are prerendered, so absolute
 URLs — `<loc>` in the sitemap, `og:image`, `canonical` — must be decided before
 the build finishes. `index.html`, `sitemap.xml` and `robots.txt` carry a
 `__PUBLIC_ORIGIN__` sentinel that survives prerendering into every generated
@@ -379,8 +394,53 @@ Unset, `PUBLIC_ORIGIN` substitutes `''` and everything stays root-relative and
 valid. It must carry the scheme: the value is substituted verbatim, so a bare
 hostname yields a `<loc>` that is not a URL.
 
+The **second** read is at runtime, by `server.mjs`, and it is why one variable
+covers both rather than a `CANONICAL_ORIGIN` that would have to stay in step
+with it — the same reasoning that keeps `CONVERTER_URL` a single value. On a
+host that only passes it as a `--build-arg` it is absent at runtime and the
+redirect below is simply off.
+
+**The canonical redirect.** Two origins serving identical pages is duplicate
+content, and only one can be the `canonical` the prerendered HTML names, so
+`backend/src/common/canonical-redirect.ts` 308s page requests on any other
+hostname to `PUBLIC_ORIGIN`. Four things about it are load-bearing:
+
+- **`/api` can never reach it, by placement rather than by a check.** It is
+  registered after Nest, whose `setGlobalPrefix('/api')` scopes the not-found
+  router to `/api`, so every `/api/*` request is answered first — Render's
+  `/api/health` probe included. `routing-contract.e2e-spec.ts` pins that.
+- **It runs before the Angular handler**, deliberately, so it also covers the
+  static files that skip Angular's host check.
+- **It changes what an unknown host sees**: a 308 here instead of Angular's
+  400. The two guards compose. Not an open redirect — the target is always
+  built from `PUBLIC_ORIGIN`, never from the request.
+- **GET/HEAD only, and never loopback**, or `node server.mjs` locally would
+  bounce to production.
+
+**It refuses to run when `PUBLIC_ORIGIN`'s host is not in `NG_ALLOWED_HOSTS`**,
+and that guard is the reason the two variables can be changed independently.
+Without it, moving `PUBLIC_ORIGIN` to a host the allowlist does not cover makes
+the alias 308 to a host Angular answers 400 for — **every page dead**, while
+`/api/health` still returns 200 so Render reports a healthy deploy and never
+rolls back. Refusing degrades that to "both hosts keep serving", and the service
+log names both values.
+
+`isHostAllowed`/`parseAllowedHosts` duplicate Angular's matcher, which is safe in
+the only direction that matters: the check can *only* disable a redirect. Drift
+that wrongly says "allowed" leaves the behaviour it would have had anyway; drift
+that wrongly says "not allowed" still serves every host. Angular's list stays the
+authority on what is served — this decides only whether to redirect.
+
+It lives under `backend/` because that is the only workspace with a test runner
+that can reach it; `server.mjs` imports it from `dist` exactly as it already
+imports `createNestApp`.
+
 **`pnpm run verify:deploy <url>`** checks the deployed result. Local green does
-not mean deployed correct.
+not mean deployed correct. It also asserts the **stamped origin matches the URL
+being verified** — a missing sentinel only proves something was substituted, not
+that the right thing was, and attaching the custom domain made every page it
+served name the old origin — and it recognises an **alias** origin, reporting
+the redirect and skipping the page checks that belong to the canonical one.
 
 **The service worker must never cache `/api`.** `ngsw-config.json` has no
 `dataGroups` at all, deliberately: a cached response would show stale money and
@@ -420,7 +480,8 @@ Getting them confused is how the UI briefly offered an Approve button that alway
 and the rate lock — no controller, deliberately), `budgets/`, `reports/` (polled job for
 the cancellation demo), `tool-calls/` (audit log), `orgs/`, `config/`
 (`GET /api/config` serves the Gemini model list so it is editable without a
-rebuild), `supabase/` (client + repository seam), `common/` (rate limiting).
+rebuild), `supabase/` (client + repository seam), `common/` (rate limiting, and the
+canonical-host redirect `server.mjs` mounts).
 Migrations live in `supabase/migrations/`. Seed users: `priya@actuo.demo`
 (owner), `arjun@actuo.demo` (member), password `Demo1234!`.
 
diff --git a/Progress.md b/Progress.md
index bc9115f..6622342 100644
--- a/Progress.md
+++ b/Progress.md
@@ -2,7 +2,7 @@
 
 Tracks every feature in the PRD against what is actually in the codebase.
 
-**Last audited:** 2026-09-03 · **Baseline:** 12 shared · 93 backend unit · 34 backend e2e · 803 frontend
+**Last audited:** 2026-09-03 · **Baseline:** 12 shared · 114 backend unit · 34 backend e2e · 803 frontend
 
 Status is evidence-based, not aspirational. A row is `DONE` only when the code
 exists, is reachable from the running app, and has a test. A file existing is not
@@ -216,7 +216,7 @@ Cross-origin is live as of 2026-08-29; only the standalone-script packaging (Pha
 | Confirmation before mutating tools | 0 | ✅ | In-chat card. PRD says "native dialog"; in-chat was chosen deliberately |
 | Key-setup flow when no key | 0 | ✅ | Opens into setup rather than failing silently |
 | Embeddable via one `<script>` | 3 | ⬜ | It is an Angular component inside the app shell |
-| **Cross-origin tool use** | 0 | ✅ | The converter is framed from `CONVERTER_URL` with `allow="tools"`, and `ConverterSession` owns discovery for all four surfaces. The synthetic partner page and its :4201 server are gone: dev and production now frame the same independently deployed converter, so there is no cross-origin path that is only exercised in one of them. **Verified 2026-09-03 in Chrome 151 with the flag**, framing the deployed converter from `localhost:4200`: all seven of its tools discovered over a real origin boundary, badges correct (4 read-only / 3 mutating), and `executeTool(convertCurrency, {amount:200,from:'EUR',to:'INR'})` returned `200 EUR = 22,018.00 INR` with the embedded widget moving to match. Not yet run from a *deployed* Actuo — see the rough edges |
+| **Cross-origin tool use** | 0 | ✅ | The converter is framed from `CONVERTER_URL` with `allow="tools"`, and `ConverterSession` owns discovery for all four surfaces. The synthetic partner page and its :4201 server are gone: dev and production now frame the same independently deployed converter, so there is no cross-origin path that is only exercised in one of them. **Verified 2026-09-03 in Chrome 151 with the flag**, first from `localhost:4200` — all seven of its tools discovered over a real origin boundary, badges correct (4 read-only / 3 mutating), and `executeTool(convertCurrency, {amount:200,from:'EUR',to:'INR'})` returning `200 EUR = 22,018.00 INR` with the embedded widget moving to match — and then **from the deployed Actuo at `/agent`**, which closes the last gap: two genuinely public origins, neither serving the other |
 
 ## §6.9 Admin & Settings — 🟡
 
@@ -238,7 +238,7 @@ Cross-origin is live as of 2026-08-29; only the standalone-script packaging (Pha
 | JSON Schema inputs | ✅ | One definition in `shared/src/tools.ts`, used by client and server |
 | **Dynamic / state-gated tools** | ✅ | The shell polls on sign-in and after every mutating call. Verified live: `approve_expense` present in `getTools()` as owner with 3 pending, absent as member, and every tool retired on sign-out |
 | Cancellation (`AbortSignal`) | ✅ | Client aborts, polls stop, server abandons the job mid-fetch and mid-format |
-| Cross-origin tools | ✅ | See §6.8. Needs a genuinely second origin — same-origin descriptors are filtered out, which is what made the earlier in-repo page unprovable. It is now a separately built, independently deployed app Actuo does not own, in dev as well as on a deploy |
+| Cross-origin tools | ✅ | See §6.8. Needs a genuinely second origin — same-origin descriptors are filtered out, which is what made the earlier in-repo page unprovable. It is now a separately built, independently deployed app Actuo does not own, and it is proven from the deploy itself, not only from localhost |
 | Security annotations | ✅ | `readOnlyHint` on all five, driving the shell's re-poll and the `/agent` panel. `untrustedContentHint` on `search_expenses` and `approve_expense` — the two that surface *another person's* free text — and on the converter's tools, whose results carry third-party rate data; shown as a badge on the tool-call card |
 | `getTools()` discovery | ✅ | Drives the cross-origin path and the `/agent` panel; re-runs on `toolchange`. The Copilot still reads its own registry for local tools, deliberately — see "the tool registry decision" |
 | `executeTool()` + manual debug panel | 🟡 | `executeTool()` done, and `/agent` renders `Copilot.crossOriginTools` and the registry's `invocationLog()`. Still read-only: there is no form to invoke a tool by hand with arbitrary arguments |
@@ -287,13 +287,13 @@ and the offline banner appearing and clearing on the network events.
 | Unit tests for tool `execute()` | ✅ | — |
 | Structured logging / error tracking | ⬜ | Nest logger only; no Sentry-tier reporting |
 | **CI** | ✅ | `.github/workflows/ci.yml` runs the full Definition of Done gate on push and PR, and **has run on GitHub** — five successful runs, most recently on PR #4 |
-| Single-process deploy | ✅ | `server.mjs`; the routing contract it depends on is pinned by `routing-contract.e2e-spec.ts` |
+| Single-process deploy | ✅ | `server.mjs`; the routing contract it depends on is pinned by `routing-contract.e2e-spec.ts`. It also mounts `common/canonical-redirect.ts`, which 308s pages on any non-canonical hostname — placed after Nest so `/api` can never reach it, and before the Angular handler so it also covers the static files that skip Angular's host check. It self-disables when `PUBLIC_ORIGIN`'s host is not in `NG_ALLOWED_HOSTS`, because that combination would 308 the alias to a host Angular 400s: every page down behind a health check that still returns 200 |
 
 ## §12 Submission criteria — 🟡
 
 | Item | Status | Notes |
 |---|---|---|
-| **Public deployed URL** | ✅ | **Live and correct at `https://actuo.onrender.com`** — `pnpm run verify:deploy https://actuo.onrender.com` passes all six checks as of 2026-09-03: `/api/health` 200, `/` server-rendered (`ng-server-context` present), `/`, `sitemap.xml` and `robots.txt` all stamped, and `/api/config` reporting the converter. `server.mjs` composes Nest under `/api` with the Angular SSR handler from a committed `Dockerfile`; Firebase App Hosting was abandoned after three distinct buildpack failures against this workspace monorepo (see README *Why a Dockerfile*). The two earlier defects — CSR fallback and a literal `__PUBLIC_ORIGIN__` — are both gone |
+| **Public deployed URL** | ✅ | **Live at `https://actuo.programmersingh.dev`**, with `https://actuo.onrender.com` kept as an alias that 308s to it. `server.mjs` composes Nest under `/api` with the Angular SSR handler from a committed `Dockerfile`; Firebase App Hosting was abandoned after three distinct buildpack failures against this workspace monorepo (see README *Why a Dockerfile*). Attaching the custom domain broke it in the documented way — every page 400'd on the new host until it was added to `NG_ALLOWED_HOSTS` — and in one that was **not** caught by any check: the SEO stamp is baked at build time, so the new domain served a sitemap, `canonical` and `og:image` all naming the old origin. `verify:deploy` now asserts the stamped origin matches the URL it is checking |
 | README | ✅ | Root `README.md`: what is WebMCP-specific and where, the flag setup, what works without it, and the deploy steps. Workspace READMEs are still starter boilerplate |
 | Demo video | ⬜ | The last box left. The script is the "What to look at" list in `README.md`, and the SSR fix it was waiting on has landed — the deployed site server-renders, so a recording made now records the real thing |
 | Source with clear tool definitions | ✅ | `shared/src/tools.ts` |
@@ -302,43 +302,31 @@ and the offline banner appearing and clearing on the network events.
 
 ## What to fix next
 
-Every Phase 0 row is green, the deploy is live *and* correct, and real FX
-landed on 2026-09-03. What is left is the rest of Phase 1, and the video.
-
-1. **Prove cross-origin from the deployed site.** `CONVERTER_URL` is set and
-   `/api/config` serves it, so this is very likely already working and merely
-   unverified. Open `https://actuo.onrender.com/agent` in flag-enabled Chrome
-   151, confirm Cambiaro's seven tools are discovered across two public origins,
-   and ask the Copilot to convert €80. Ten minutes, and it turns §7's
-   cross-origin row from locally-proven into deploy-proven.
-2. **Demo video** — the last §12 checkbox. The script is the "What to look at"
-   list in `README.md`.
-3. **Budgets depth** — `POST /budgets` inserts and there is no PATCH, so a
-   budget can be set once and not changed; the form hides categories that
-   already have one rather than offering a guaranteed 409. Threshold alerts
-   (80%) and rollover-vs-reset are the other two §6.3 rows, and `budgets.spec.ts`
-   already guards the rollover checkbox against returning without its behaviour.
-4. **`/api/analytics/*`** — no controller; the dashboard derives everything
+Every Phase 0 row is green, real FX landed on 2026-09-03, the deploy is live on
+its own domain, and cross-origin is proven from that deploy. What is left is the
+rest of Phase 1, and the video.
+
+1. **Budgets depth** — three open §6.3 rows, one surface. `POST /budgets`
+   inserts and there is no PATCH, so a budget can be set once and not changed;
+   the form hides categories that already have one rather than offering a
+   guaranteed 409. Threshold alerts (80%) and rollover-vs-reset are the other
+   two, and `budgets.spec.ts` already guards the rollover checkbox against
+   returning without its behaviour.
+2. **`/api/analytics/*`** — no controller; the dashboard derives everything
    client-side. Standalone spend-by-category and a month-over-month delta tile
    are the visible half.
-5. **Recurring expenses** — `recurring_templates` is in PRD §8.7 and **absent
+3. **Recurring expenses** — `recurring_templates` is in PRD §8.7 and **absent
    from the migrations**, so it needs `0004`.
-6. **Org invites** — the last Phase 1 row, and the only one needing an external
+4. **Org invites** — the last Phase 1 row, and the only one needing an external
    service (Resend, plus a `sync: false` secret in `render.yaml`).
-7. **Everything else is Phase 2–3**: receipt OCR, notifications, multi-step
+5. **Demo video** — the last §12 checkbox. The script is the "What to look at"
+   list in `README.md`.
+6. **Everything else is Phase 2–3**: receipt OCR, notifications, multi-step
    approval chains, comment threads, teams, tags, CSV import, PDF export,
    session management, and packaging the Copilot as a standalone script.
 
 ### Known rough edges, deliberately not fixed here
 
-- **The cross-origin path has not been run end to end from a *deployed* Actuo.**
-  It is verified locally against the deployed converter (see §6.8), but nobody
-  has yet loaded Actuo on Render, framed the converter from there, and watched
-  the Copilot call `convertCurrency` across two public origins. The two blockers
-  are gone — the converter commits are deployed and `CONVERTER_URL` is set, so
-  `/api/config` now serves `https://cambiaro.programmersingh.dev/`. All that is
-  left is opening `https://actuo.onrender.com/agent` in flag-enabled Chrome and
-  watching it work.
 - **The Firebase App Hosting backend may still be connected** with auto-rollouts,
   in which case it fails on every push. Deleting it is
   `firebase apphosting:backends:delete actuo --project actuo-2f1f3`. App Hosting
@@ -351,7 +339,8 @@ landed on 2026-09-03. What is left is the rest of Phase 1, and the video.
 - **No CSP header is set anywhere yet.** When one lands it will need `frame-src`
   for the converter origin (`CONVERTER_URL`) — one origin now, not two — or
   every converter surface breaks silently: an iframe blocked by CSP renders
-  empty with no error the page can see.
+  empty with no error the page can see. It also has to be written against the
+  *canonical* host, since that is the only origin that serves pages now.
 - **Brand assets are generated, not designed.** `scripts/generate-brand-assets.mjs`
   produces the icons and og card from the palette with ImageMagick. They are
   clean but plain, and regenerating after a palette change is manual.
diff --git a/README.md b/README.md
index 41fc1fe..2f4fc12 100644
--- a/README.md
+++ b/README.md
@@ -216,24 +216,42 @@ project before the first deploy.
 the image build, and free build memory is not enough. Free instances also spin
 down when idle, and the cold start here is an image pull plus a Nest boot.
 
-**`PUBLIC_ORIGIN` is build-time**, and works on Render without a `--build-arg`
-flag: Render translates a service environment variable into a Docker build
-argument, and the Dockerfile declares `ARG PUBLIC_ORIGIN` to receive it. It is
-set to `https://actuo.onrender.com`; change it when a custom domain is attached
-and **redeploy**, because a runtime variable cannot reach already-prerendered
-HTML.
+**`PUBLIC_ORIGIN` is the canonical origin, and changing it needs a redeploy.**
+Its build-time half works on Render without a `--build-arg` flag: Render
+translates a service environment variable into a Docker build argument, and the
+Dockerfile declares `ARG PUBLIC_ORIGIN` to receive it. A runtime variable cannot
+reach already-prerendered HTML, so a restart is not enough.
+
+`server.mjs` reads it again at runtime and **308-redirects page requests
+arriving on any other hostname** to it, so the two origins the service answers
+on do not compete as duplicate content. `/api` is never redirected, and neither
+is `localhost`. It also **switches itself off** if `PUBLIC_ORIGIN` names a host
+missing from `NG_ALLOWED_HOSTS` — that pairing would redirect the alias to a
+host Angular answers 400 for, taking every page down while `/api/health` still
+reported healthy.
+
+**The site answers on two hostnames**, and both must be in `NG_ALLOWED_HOSTS`
+(a comma-separated list) or their pages return `400 Bad Request` naming the
+host:
+
+| Hostname | Role |
+|---|---|
+| `actuo.programmersingh.dev` | canonical — `PUBLIC_ORIGIN`, and what every `canonical`, `og:image` and sitemap `<loc>` names |
+| `actuo.onrender.com` | alias — 308s to the canonical one |
 
-After any deploy, run the smoke check:
+After any deploy, run the smoke check against the canonical origin:
 
 ```bash
-pnpm run verify:deploy https://actuo.onrender.com
+pnpm run verify:deploy https://actuo.programmersingh.dev
+pnpm run verify:deploy https://actuo.onrender.com    # expects the redirect
 ```
 
-It checks the four things that are only true when the deploy is correct — the API
+It checks the things that are only true when the deploy is correct — the API
 answers, `/` actually server-renders, no `__PUBLIC_ORIGIN__` sentinel survives,
-and the converter is configured on another origin — and names the fix for each
-failure. Every check is there because that thing broke in production without
-anything else noticing.
+the stamped origin *matches the URL being checked*, and the converter is
+configured on another origin — and names the fix for each failure. Every check
+is there because that thing broke in production without anything else
+noticing.
 
 ### Anywhere else
 
diff --git a/backend/src/common/canonical-redirect.spec.ts b/backend/src/common/canonical-redirect.spec.ts
new file mode 100644
index 0000000..2fb0a1b
--- /dev/null
+++ b/backend/src/common/canonical-redirect.spec.ts
@@ -0,0 +1,280 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { NextFunction, Request, Response } from 'express';
+import {
+  canonicalRedirect,
+  isHostAllowed,
+  parseAllowedHosts,
+  requestHost,
+} from './canonical-redirect.js';
+
+const CANONICAL = 'https://actuo.programmersingh.dev';
+
+/** What production runs: both hostnames the service answers on. */
+const ALLOWED = '*.onrender.com,actuo.programmersingh.dev';
+
+function run(
+  origin: string | undefined,
+  req: { method?: string; url?: string; headers?: Record<string, unknown> },
+  allowedHosts: string | undefined = ALLOWED,
+) {
+  const redirect = vi.fn();
+  const next = vi.fn();
+  const middleware = canonicalRedirect(origin, allowedHosts);
+
+  middleware(
+    { method: 'GET', url: '/', headers: {}, ...req } as unknown as Request,
+    { redirect } as unknown as Response,
+    next as unknown as NextFunction,
+  );
+
+  return {
+    redirectedTo: redirect.mock.calls[0]?.[1] as string | undefined,
+    status: redirect.mock.calls[0]?.[0] as number | undefined,
+    passedThrough: next.mock.calls.length > 0,
+  };
+}
+
+describe('requestHost', () => {
+  it('prefers x-forwarded-host, which is the only true one behind a proxy', () => {
+    expect(
+      requestHost({
+        headers: { host: '10.0.0.7:8080', 'x-forwarded-host': 'actuo.onrender.com' },
+      } as unknown as Request),
+    ).toBe('actuo.onrender.com');
+  });
+
+  it('takes the first entry of a forwarded chain', () => {
+    expect(
+      requestHost({
+        headers: { 'x-forwarded-host': 'actuo.onrender.com, inner.example' },
+      } as unknown as Request),
+    ).toBe('actuo.onrender.com');
+  });
+
+  it('falls back to host when the forwarded header is blank', () => {
+    // Blank is absent, not an answer — otherwise a proxy sending an empty
+    // header would make every request hostless and skip the redirect.
+    expect(
+      requestHost({ headers: { host: 'actuo.onrender.com', 'x-forwarded-host': '' } } as unknown as Request),
+    ).toBe('actuo.onrender.com');
+  });
+
+  it('strips the port and lowercases, so a hostname compares to a hostname', () => {
+    expect(requestHost({ headers: { host: 'Actuo.OnRender.com:443' } } as unknown as Request)).toBe(
+      'actuo.onrender.com',
+    );
+  });
+
+  it('is empty when nothing says', () => {
+    expect(requestHost({ headers: {} } as unknown as Request)).toBe('');
+  });
+});
+
+describe('canonicalRedirect', () => {
+  it('sends another hostname to the canonical origin, keeping path and query', () => {
+    const { status, redirectedTo } = run(CANONICAL, {
+      url: '/agent?tab=tools',
+      headers: { host: 'actuo.onrender.com' },
+    });
+
+    expect(status).toBe(308);
+    expect(redirectedTo).toBe('https://actuo.programmersingh.dev/agent?tab=tools');
+  });
+
+  it('leaves the canonical hostname alone', () => {
+    const { passedThrough } = run(CANONICAL, {
+      headers: { host: 'actuo.programmersingh.dev' },
+    });
+    expect(passedThrough).toBe(true);
+  });
+
+  it('ignores the port when comparing', () => {
+    const { passedThrough } = run(CANONICAL, {
+      headers: { host: 'actuo.programmersingh.dev:443' },
+    });
+    expect(passedThrough).toBe(true);
+  });
+
+  it.each(['localhost', 'localhost:4200', '127.0.0.1', '::1', '[::1]', '[::1]:8080'])(
+    'never redirects %s',
+    (host) => {
+      // `node server.mjs` locally must not bounce to production. The IPv6 forms
+      // are here because a blanket port-strip turns `::1` into `:`, which
+      // matches no loopback entry and redirects.
+      const { passedThrough } = run(CANONICAL, { headers: { host } });
+      expect(passedThrough).toBe(true);
+    },
+  );
+
+  it.each(['POST', 'PATCH', 'DELETE'])('does not redirect %s', (method) => {
+    // A redirected write is a replayed body, and nothing that mutates should
+    // depend on which hostname it was addressed to.
+    const { passedThrough } = run(CANONICAL, { method, headers: { host: 'actuo.onrender.com' } });
+    expect(passedThrough).toBe(true);
+  });
+
+  it('is a pass-through when no origin is configured', () => {
+    // On a host that passes PUBLIC_ORIGIN only as a build arg it is absent at
+    // runtime; serving every host beats guessing at a canonical one.
+    for (const origin of [undefined, '', '   ']) {
+      expect(run(origin, { headers: { host: 'actuo.onrender.com' } }).passedThrough).toBe(true);
+    }
+  });
+
+  it('is a pass-through, and says why, when the origin is not a URL', () => {
+    const onDisabled = vi.fn();
+    const middleware = canonicalRedirect('actuo.programmersingh.dev', ALLOWED, onDisabled);
+    const next = vi.fn();
+
+    middleware(
+      { method: 'GET', url: '/', headers: { host: 'actuo.onrender.com' } } as unknown as Request,
+      { redirect: vi.fn() } as unknown as Response,
+      next as unknown as NextFunction,
+    );
+
+    // A bare hostname has no scheme, so `new URL` throws. Failing open is the
+    // safe direction; failing silently is not.
+    expect(next).toHaveBeenCalled();
+    expect(onDisabled).toHaveBeenCalledOnce();
+  });
+
+  it('builds the target from the configured origin, never from the request', () => {
+    // The guard against this becoming an open redirect: a hostile Host header
+    // decides only *whether* to redirect, never where to.
+    const { redirectedTo } = run(CANONICAL, {
+      url: '/',
+      headers: { host: 'evil.example.com', 'x-forwarded-host': 'evil.example.com' },
+    });
+
+    expect(redirectedTo).toBe('https://actuo.programmersingh.dev/');
+  });
+
+  it('does not redirect when no hostname can be determined', () => {
+    const { passedThrough } = run(CANONICAL, { headers: {} });
+    expect(passedThrough).toBe(true);
+  });
+});
+
+describe('parseAllowedHosts', () => {
+  it('splits, trims and drops empties, as @angular/ssr does', () => {
+    expect(parseAllowedHosts(' a.example , , b.example ')).toEqual(['a.example', 'b.example']);
+  });
+
+  it('is empty when unset or blank', () => {
+    expect(parseAllowedHosts(undefined)).toEqual([]);
+    expect(parseAllowedHosts('  ')).toEqual([]);
+  });
+});
+
+describe('isHostAllowed', () => {
+  it('matches exactly', () => {
+    expect(isHostAllowed('actuo.programmersingh.dev', ['actuo.programmersingh.dev'])).toBe(true);
+    expect(isHostAllowed('other.programmersingh.dev', ['actuo.programmersingh.dev'])).toBe(false);
+  });
+
+  it('matches a *. entry by suffix, but not the bare apex', () => {
+    expect(isHostAllowed('actuo.onrender.com', ['*.onrender.com'])).toBe(true);
+    // `.slice(1)` leaves '.onrender.com', so the apex has no leading dot to match.
+    expect(isHostAllowed('onrender.com', ['*.onrender.com'])).toBe(false);
+  });
+
+  it('lets * through', () => {
+    expect(isHostAllowed('anything.example', ['*'])).toBe(true);
+  });
+
+  it('rejects everything when the list is empty', () => {
+    expect(isHostAllowed('actuo.programmersingh.dev', [])).toBe(false);
+  });
+});
+
+describe('the allowlist guard', () => {
+  /*
+   * The one misconfiguration that takes the whole site down: the alias 308s to
+   * a host Angular answers 400 for, while /api/health still returns 200 so
+   * Render reports a healthy deploy and never rolls back.
+   */
+  it('refuses to redirect to a host NG_ALLOWED_HOSTS does not cover', () => {
+    const { passedThrough } = run(
+      CANONICAL,
+      { headers: { host: 'actuo.onrender.com' } },
+      '*.onrender.com',
+    );
+
+    // Degraded to "both hosts keep serving" — wrong, but not down.
+    expect(passedThrough).toBe(true);
+  });
+
+  it('says why, naming both values, so the service log explains itself', () => {
+    const onDisabled = vi.fn();
+    canonicalRedirect(CANONICAL, '*.onrender.com', onDisabled);
+
+    expect(onDisabled).toHaveBeenCalledOnce();
+    const reason = onDisabled.mock.calls[0][0] as string;
+    expect(reason).toContain('actuo.programmersingh.dev');
+    expect(reason).toContain('*.onrender.com');
+    expect(reason).toContain('NG_ALLOWED_HOSTS');
+  });
+
+  it('redirects once the canonical host is listed exactly', () => {
+    const { status, redirectedTo } = run(
+      CANONICAL,
+      { headers: { host: 'actuo.onrender.com' } },
+      ALLOWED,
+    );
+
+    expect(status).toBe(308);
+    expect(redirectedTo).toBe('https://actuo.programmersingh.dev/');
+  });
+
+  it('accepts the canonical host via a *. suffix entry', () => {
+    const { status } = run(
+      CANONICAL,
+      { headers: { host: 'actuo.onrender.com' } },
+      '*.onrender.com,*.programmersingh.dev',
+    );
+    expect(status).toBe(308);
+  });
+
+  it('accepts it via *', () => {
+    const { status } = run(CANONICAL, { headers: { host: 'actuo.onrender.com' } }, '*');
+    expect(status).toBe(308);
+  });
+
+  it.each([undefined, '', '   '])(
+    'disables the redirect when NG_ALLOWED_HOSTS is %p',
+    (allowed) => {
+      // Built directly rather than through `run`, whose default parameter would
+      // substitute ALLOWED for an explicit undefined and test nothing.
+      const middleware = canonicalRedirect(CANONICAL, allowed);
+      const next = vi.fn();
+      const redirect = vi.fn();
+
+      middleware(
+        { method: 'GET', url: '/', headers: { host: 'actuo.onrender.com' } } as unknown as Request,
+        { redirect } as unknown as Response,
+        next as unknown as NextFunction,
+      );
+
+      // Angular then allows only angular.json's localhost/127.0.0.1, so the
+      // canonical host would 400 — redirecting to it would be an outage.
+      expect(next).toHaveBeenCalled();
+      expect(redirect).not.toHaveBeenCalled();
+    },
+  );
+
+  it('is decided once at construction, not per request', () => {
+    const onDisabled = vi.fn();
+    const middleware = canonicalRedirect(CANONICAL, '*.onrender.com', onDisabled);
+
+    for (let i = 0; i < 3; i += 1) {
+      middleware(
+        { method: 'GET', url: '/', headers: { host: 'actuo.onrender.com' } } as unknown as Request,
+        { redirect: vi.fn() } as unknown as Response,
+        vi.fn() as unknown as NextFunction,
+      );
+    }
+
+    // A per-request warning would flood the service log on a misconfigured deploy.
+    expect(onDisabled).toHaveBeenCalledOnce();
+  });
+});
diff --git a/backend/src/common/canonical-redirect.ts b/backend/src/common/canonical-redirect.ts
new file mode 100644
index 0000000..ab67328
--- /dev/null
+++ b/backend/src/common/canonical-redirect.ts
@@ -0,0 +1,160 @@
+import type { NextFunction, Request, Response } from 'express';
+
+/**
+ * Sends page requests arriving on any other hostname to the canonical one.
+ *
+ * Two origins serving identical pages is duplicate content, and only one of
+ * them can be the `canonical` the prerendered HTML names — so the other has to
+ * point at it rather than answer 200 alongside it. Actuo answers on both
+ * `actuo.onrender.com` and `actuo.programmersingh.dev`.
+ *
+ * It lives in `backend/` rather than beside `server.mjs` for one reason: this is
+ * the only place with a test runner that can reach it. `server.mjs` imports it
+ * from `backend/dist`, the same way it already imports `createNestApp`.
+ */
+
+/** Local hostnames never redirect, mirroring `angular.json`'s own allowlist. */
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+
+/**
+ * The hostname a request believes it arrived on, lowercased and without a port.
+ *
+ * `x-forwarded-host` wins because behind Render's proxy `host` is the internal
+ * address — the same header Angular's allowlist reads. A blank one falls
+ * through to `host` rather than counting as an answer, and a comma-joined
+ * forwarded chain takes its first entry.
+ */
+export function requestHost(req: Pick<Request, 'headers'>): string {
+  const forwarded = req.headers['x-forwarded-host'];
+  const first = (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(',')[0]?.trim();
+  const raw = (first || req.headers.host || '').trim();
+  return stripPort(raw).toLowerCase();
+}
+
+/**
+ * `NG_ALLOWED_HOSTS` as a list, parsed the way Angular parses it.
+ *
+ * Mirrors `getArrayFromEnv` in `@angular/ssr`: split on `,`, trim, drop empties.
+ */
+export function parseAllowedHosts(value: string | undefined): string[] {
+  return (value ?? '')
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+}
+
+/**
+ * Whether Angular would serve this hostname — mirrors its `isHostAllowed`.
+ *
+ * `*` allows everything; otherwise an exact match, or a suffix match for a
+ * `*.` entry (`hostname.endsWith('.example.com')`, which deliberately does not
+ * cover the bare apex).
+ */
+export function isHostAllowed(hostname: string, allowedHosts: readonly string[]): boolean {
+  if (allowedHosts.includes('*') || allowedHosts.includes(hostname)) return true;
+  return allowedHosts.some(
+    (entry) => entry.startsWith('*.') && hostname.endsWith(entry.slice(1)),
+  );
+}
+
+/**
+ * Drops a trailing `:port`, without mangling an IPv6 literal.
+ *
+ * A blanket `/:\d+$/` turns `::1` into `:`, which then matches no loopback
+ * entry and redirects. Bracketed IPv6 (`[::1]:8080`) is the form a Host header
+ * is supposed to use, but the bare one shows up too.
+ */
+function stripPort(host: string): string {
+  if (host.startsWith('[')) return host.replace(/^(\[[^\]]*\]):\d+$/, '$1');
+  // More than one colon means a bare IPv6 literal, which carries no port.
+  if (host.split(':').length > 2) return host;
+  return host.replace(/:\d+$/, '');
+}
+
+/**
+ * Express middleware redirecting to `canonicalOrigin`, or a pass-through when
+ * there is none.
+ *
+ * **`/api` can never reach this**, and that is placement rather than a check:
+ * `server.mjs` registers it after Nest, whose `setGlobalPrefix('/api')` scopes
+ * the not-found router to `/api` so every `/api/*` request is answered before
+ * anything downstream sees it — Render's `/api/health` probe included.
+ * `test/routing-contract.e2e-spec.ts` is what pins that.
+ *
+ * An unparseable or absent origin disables it entirely. That is the right
+ * default: on a host that passes `PUBLIC_ORIGIN` only as a `--build-arg` it
+ * does not exist at runtime, and serving every host beats guessing at one.
+ *
+ * 308 rather than 302 so the two origins consolidate for crawlers. The cost is
+ * that browsers cache it hard: if the canonical domain's DNS or certificate
+ * ever lapses, a visitor holding the redirect cannot fall back to the other
+ * hostname. Worth knowing before changing `PUBLIC_ORIGIN`.
+ *
+ * It also changes what an UNKNOWN host sees. Running ahead of Angular's
+ * allowlist, this redirects anything non-canonical, so a host on neither list
+ * gets a 308 here instead of Angular's 400 — the two guards compose rather than
+ * one replacing the other, and `NG_ALLOWED_HOSTS` still governs the canonical
+ * host itself. Not an open redirect: the target is always built from the
+ * configured origin, never from the request.
+ */
+export function canonicalRedirect(
+  canonicalOrigin: string | undefined,
+  allowedHostsEnv: string | undefined,
+  onDisabled?: (reason: string) => void,
+): (req: Request, res: Response, next: NextFunction) => void {
+  let canonical: URL | null = null;
+  const configured = canonicalOrigin?.trim();
+
+  if (configured) {
+    try {
+      canonical = new URL(configured);
+    } catch {
+      onDisabled?.(`PUBLIC_ORIGIN is not a URL (${configured}); canonical redirect disabled.`);
+    }
+  }
+
+  /*
+   * The guard against the one misconfiguration that takes the whole site down.
+   *
+   * PUBLIC_ORIGIN naming a host that NG_ALLOWED_HOSTS does not cover means the
+   * alias 308s to a host Angular answers 400 for: every page dead, while
+   * `/api/health` still returns 200 so Render reports a healthy deploy and
+   * never rolls back. Refusing to redirect degrades that to "both hosts keep
+   * serving", which is merely wrong rather than down.
+   *
+   * This re-implements Angular's matcher, and that duplication is safe in one
+   * direction only — which is the direction that matters. The check can only
+   * ever DISABLE a redirect: if it drifts and wrongly says "allowed" the
+   * behaviour is what it would have been without the guard at all, and if it
+   * wrongly says "not allowed" the site still serves on every host. It cannot
+   * make anything worse than not having it. Angular's own list stays the
+   * authority on what gets served; this only decides whether to redirect.
+   *
+   * An unset NG_ALLOWED_HOSTS lands here too, correctly: Angular then allows
+   * only angular.json's localhost/127.0.0.1, so a canonical host would 400.
+   */
+  if (canonical) {
+    const allowedHosts = parseAllowedHosts(allowedHostsEnv);
+    if (!isHostAllowed(canonical.hostname, allowedHosts)) {
+      onDisabled?.(
+        `PUBLIC_ORIGIN host "${canonical.hostname}" is not covered by NG_ALLOWED_HOSTS ` +
+          `(${allowedHostsEnv?.trim() || 'unset'}); canonical redirect disabled. ` +
+          'Redirecting to a host Angular answers 400 for would take every page down. ' +
+          'Add it to NG_ALLOWED_HOSTS to enable the redirect.',
+      );
+      canonical = null;
+    }
+  }
+
+  return (req, res, next) => {
+    if (!canonical) return next();
+    // Only GET/HEAD: a redirected POST is a replayed body, and nothing that
+    // mutates should depend on which hostname it was addressed to.
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+
+    const host = requestHost(req);
+    if (!host || host === canonical.hostname || LOOPBACK.has(host)) return next();
+
+    res.redirect(308, new URL(req.originalUrl ?? req.url, canonical).toString());
+  };
+}
diff --git a/render.yaml b/render.yaml
index 6fcc98a..a6888e6 100644
--- a/render.yaml
+++ b/render.yaml
@@ -26,6 +26,12 @@ services:
     dockerfilePath: ./Dockerfile
     dockerContext: .
 
+    # Already attached in the dashboard; declared here so the repo is the record
+    # of what this service answers on. Every hostname listed must also appear in
+    # NG_ALLOWED_HOSTS below, or its pages 400.
+    domains:
+      - actuo.programmersingh.dev
+
     # `/api/health` is @Public() — it is the one route that answers before any
     # credential exists, which is what makes it usable as a probe. A 5xx here
     # means Nest booted but its own health route is failing, not that a secret
@@ -34,30 +40,39 @@ services:
     healthCheckPath: /api/health
 
     envVars:
-      # Angular 21 checks the Host header against an allowlist (SSRF protection).
-      # Off the list it does NOT error — it silently falls back to client-side
-      # rendering, discarding the SSR and structured-data work in PRD §8.5. This
-      # REPLACES the build-time list in angular.json, so every hostname the
-      # service answers on has to be here. Matching is by suffix, so one wildcard
-      # covers `actuo.onrender.com` and any preview hostname.
+      # Angular checks the Host header against an allowlist (SSRF protection).
+      # A miss on a configured list is a 400 text/plain, naming the host; only
+      # an EMPTY list falls back to client-side rendering instead.
+      #
+      # Comma-separated, and UNIONED with angular.json's own
+      # security.allowedHosts rather than replacing it — AngularAppEngine builds
+      # `new Set([...envList, ...manifest.allowedHosts])` — so localhost keeps
+      # working no matter what is listed here.
       #
-      # Verify after deploying: the HTML for `/` must contain `ng-server-context`.
-      # If it does not, this value is wrong and the site is rendering client-side.
+      # `*.onrender.com` is a suffix match (hostname.endsWith('.onrender.com')),
+      # kept so preview hostnames render. The custom domain is listed exactly:
+      # `*.programmersingh.dev` would admit every other subdomain of that zone.
+      #
+      # Verify after deploying: the HTML for `/` must contain `ng-server-context`
+      # on every hostname the service answers on.
       - key: NG_ALLOWED_HOSTS
-        value: "*.onrender.com"
+        value: "*.onrender.com,actuo.programmersingh.dev"
 
-      # BUILD-TIME, and it works here only because Render translates a service
-      # env var into a Docker build argument automatically — the Dockerfile
-      # declares `ARG PUBLIC_ORIGIN` to receive it. The public pages are
-      # prerendered, so `<loc>`, `og:image` and `canonical` are baked before the
-      # image finishes; there is no request to derive an origin from.
+      # The origin this deploy calls its own — read TWICE, and changing it needs
+      # a REBUILD, not a restart.
+      #
+      #  * At build time by stamp-seo.mjs. Render turns a service env var into a
+      #    Docker build argument automatically and the Dockerfile declares
+      #    `ARG PUBLIC_ORIGIN` to receive it. The public pages are prerendered,
+      #    so `<loc>`, `og:image` and `canonical` are baked before the image
+      #    finishes — there is no request to derive an origin from.
+      #  * At runtime by server.mjs, which 308-redirects page requests arriving
+      #    on any other host here. Unset, that redirect is simply off.
       #
-      # It must carry the scheme: stamp-seo.mjs substitutes the value verbatim,
-      # so a bare hostname produces a `<loc>` that is not a URL. Change this when
-      # a custom domain is attached, and redeploy — a rebuild is required, since
-      # a runtime variable cannot reach prerendered HTML.
+      # It must carry the scheme: stamp-seo.mjs substitutes it verbatim, so a
+      # bare hostname produces a `<loc>` that is not a URL.
       - key: PUBLIC_ORIGIN
-        value: https://actuo.onrender.com
+        value: https://actuo.programmersingh.dev
 
       # Not a credential; the service-role key below is.
       - key: SUPABASE_URL
@@ -88,8 +103,8 @@ services:
       # cross-origin path would prove nothing. Cambiaro is a genuinely separate
       # deployment, which is the point.
       #
-      # RUNTIME, unlike PUBLIC_ORIGIN above: nothing about it is prerendered,
-      # so changing it needs a restart rather than a rebuild.
+      # RUNTIME only: nothing about it is prerendered, so changing it needs a
+      # restart rather than the rebuild PUBLIC_ORIGIN above needs.
       - key: CONVERTER_URL
         value: https://cambiaro.programmersingh.dev/
 
diff --git a/scripts/verify-deploy.mjs b/scripts/verify-deploy.mjs
index e73b057..395f41d 100644
--- a/scripts/verify-deploy.mjs
+++ b/scripts/verify-deploy.mjs
@@ -11,6 +11,9 @@
  */
 
 const SENTINEL = '__PUBLIC_ORIGIN__';
+
+/** Not a failure: the check does not apply to this origin. */
+class Skip extends Error {}
 const TIMEOUT_MS = 20_000;
 
 const base = (process.argv[2] ?? process.env.DEPLOY_URL ?? '').trim().replace(/\/+$/, '');
@@ -19,10 +22,31 @@ if (!base) {
   process.exit(2);
 }
 
-async function get(path) {
+async function get(path, { follow = true } = {}) {
   const url = `${base}${path}`;
-  const response = await fetch(url, { signal: AbortSignal.timeout(TIMEOUT_MS) });
-  return { url, status: response.status, body: await response.text() };
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+    // `manual` is how an alias origin is caught: fetch follows redirects by
+    // default, so every check below would silently describe the canonical
+    // origin while claiming to describe this one.
+    redirect: follow ? 'follow' : 'manual',
+  });
+  return {
+    url,
+    status: response.status,
+    location: response.headers.get('location'),
+    body: await response.text(),
+  };
+}
+
+/** The absolute URL the SEO stamp wrote into each file, or null. */
+function stampedUrl(path, text) {
+  const pattern = {
+    '/': /<link rel="canonical" href="([^"]+)"/,
+    '/sitemap.xml': /<loc>([^<]+)<\/loc>/,
+    '/robots.txt': /^Sitemap:\s*(\S+)/m,
+  }[path];
+  return pattern ? (pattern.exec(text)?.[1] ?? null) : null;
 }
 
 const failures = [];
@@ -44,9 +68,24 @@ try {
   fail('/api/health', String(error), 'The deploy is unreachable, or still waking up.');
 }
 
+// --- Is this the canonical origin, or an alias that redirects to it? --------
+let isAlias = false;
+try {
+  const { status, location } = await get('/', { follow: false });
+  if (status >= 300 && status < 400 && location) {
+    isAlias = true;
+    const target = new URL(location, base).origin;
+    pass('/ canonical redirect', `${status} -> ${target}`);
+    console.log(`\n  This origin is an alias. Run the checks below against ${target}.\n`);
+  }
+} catch (error) {
+  fail('/ canonical redirect', String(error), 'Could not fetch it.');
+}
+
 // --- SSR is actually on -----------------------------------------------------
 let home = '';
 try {
+  if (isAlias) throw new Skip();
   const { status, body } = await get('/');
   home = body;
   /*
@@ -71,11 +110,12 @@ try {
     );
   }
 } catch (error) {
-  fail('/', String(error), 'The deploy is unreachable.');
+  if (!(error instanceof Skip)) fail('/', String(error), 'The deploy is unreachable.');
 }
 
 // --- The SEO stamp reached every copy of the HTML ---------------------------
 for (const [path, body] of [['/', home], ['/sitemap.xml', null], ['/robots.txt', null]]) {
+  if (isAlias) break;
   try {
     const text = body ?? (await get(path)).body;
     if (!text) continue;
@@ -85,8 +125,24 @@ for (const [path, body] of [['/', home], ['/sitemap.xml', null], ['/robots.txt',
         `still contains ${SENTINEL}`,
         'PUBLIC_ORIGIN is a BUILD arg, so a restart cannot fix it — redeploy. If only some paths are affected, scripts/stamp-seo.mjs is not covering the whole dist tree.',
       );
+      continue;
+    }
+
+    /*
+     * A missing sentinel only proves something was substituted, not that the
+     * right thing was. With a custom domain attached, the stamp kept naming the
+     * old origin on every page the new one served — canonical, og:image and
+     * <loc> all pointing somewhere else, which no other check here noticed.
+     */
+    const stamped = stampedUrl(path, text);
+    if (stamped && new URL(stamped).origin !== new URL(base).origin) {
+      fail(
+        `${path} stamped`,
+        `names ${new URL(stamped).origin}, not ${new URL(base).origin}`,
+        'PUBLIC_ORIGIN is set to a different origin than the one being verified. It is a BUILD arg, so change it and REDEPLOY — a restart cannot reach prerendered HTML.',
+      );
     } else {
-      pass(`${path} stamped`, 'no sentinel');
+      pass(`${path} stamped`, stamped ? `names ${new URL(stamped).origin}` : 'no sentinel');
     }
   } catch (error) {
     fail(`${path} stamped`, String(error), 'Could not fetch it.');
diff --git a/server.mjs b/server.mjs
index 000bbd5..4373dbd 100644
--- a/server.mjs
+++ b/server.mjs
@@ -47,6 +47,10 @@ async function loadBuilt(specifier, what) {
 }
 
 const { createNestApp } = await loadBuilt('./backend/dist/bootstrap.js', 'the backend build');
+const { canonicalRedirect } = await loadBuilt(
+  './backend/dist/common/canonical-redirect.js',
+  'the backend build',
+);
 const { reqHandler } = await loadBuilt(
   './frontend/dist/frontend/server/server.mjs',
   'the frontend SSR build',
@@ -61,7 +65,25 @@ const nest = await createNestApp();
  * routes, it is the fallback for everything that is not `/api/*`: static assets
  * from `dist/browser`, then server-side rendering.
  */
-nest.getHttpAdapter().getInstance().use(reqHandler);
+const express = nest.getHttpAdapter().getInstance();
+
+/*
+ * ORDER IS SIGNIFICANT. The redirect goes before the Angular handler so it also
+ * covers the static assets that handler serves — `sitemap.xml` and `robots.txt`
+ * among them, which otherwise answer 200 on every hostname because
+ * `express.static` runs ahead of Angular's host check and never sees it.
+ *
+ * `PUBLIC_ORIGIN` is the same value `stamp-seo.mjs` bakes into `<loc>`,
+ * `canonical` and `og:image` at build time — reused rather than paired with a
+ * second variable that would have to stay in step with it. Unset, the redirect
+ * is a pass-through.
+ */
+express.use(
+  canonicalRedirect(process.env.PUBLIC_ORIGIN, process.env.NG_ALLOWED_HOSTS, (why) =>
+    console.warn(`[actuo] ${why}`),
+  ),
+);
+express.use(reqHandler);
 
 // 0.0.0.0, not the default localhost: a container that binds the loopback
 // interface passes its own health check and is unreachable from outside.