diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bf524e31..004e1eef 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -52,7 +52,11 @@ jobs:
       (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging')
     environment:
       name: staging
-      url: https://dev.codeframeapp.com
+      # dev.codeframeapp.com has DNS to this box but no nginx site and no
+      # certificate, so the shared VPS serves another project's cert and TLS
+      # fails. The GitHub deployment link therefore looked like staging was
+      # down when it was serving fine. dev.codeframe.sh is the real host.
+      url: https://dev.codeframe.sh
 
     steps:
       - name: Checkout code
diff --git a/deploy/README.md b/deploy/README.md
index 83a0ee41..e9d85117 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -24,6 +24,12 @@ ever travel over HTTPS/WSS between the browser and Caddy. Plaintext
    sudo systemctl reload caddy
    ```
    Caddy provisions and renews the Let's Encrypt certificate automatically.
+> **Staging lives at <https://dev.codeframe.sh>.** It runs behind nginx on a
+> shared VPS (`/etc/nginx/sites-available/dev.codeframe.sh.conf`), with the
+> backend on 14200 and the frontend on 14100 under pm2. `dev.codeframeapp.com`
+> is an older domain that was never finished — it resolves to the same box but
+> has no site block and no certificate.
+
 3. Set the public origins in `.env.staging` / `.env.production`:
    ```
    NEXT_PUBLIC_API_URL=https://your-domain
diff --git a/legacydocs/nginx-setup-complete.md b/legacydocs/nginx-setup-complete.md
index cfa217ca..c1b39352 100644
--- a/legacydocs/nginx-setup-complete.md
+++ b/legacydocs/nginx-setup-complete.md
@@ -1,3 +1,10 @@
+> **SUPERSEDED — do not follow.** This documents `dev.codeframeapp.com` on
+> `47.88.89.175`. Both are dead: the box was rebuilt at `195.35.14.177` on
+> 2026-07-01 and staging is now **<https://dev.codeframe.sh>**, configured at
+> `/etc/nginx/sites-available/dev.codeframe.sh.conf`. `dev.codeframeapp.com`
+> still resolves to the new box but has no site block and no certificate, so it
+> fails TLS. Kept for history only; see `deploy/README.md`.
+
 # Nginx & SSL Configuration Complete
 
 **Date**: 2025-10-25