diff --git a/packages/api/wrangler.jsonc b/packages/api/wrangler.jsonc
index 637594a..2d45db5 100644
--- a/packages/api/wrangler.jsonc
+++ b/packages/api/wrangler.jsonc
@@ -13,6 +13,16 @@
 	// Custom domain / route the redirect endpoint should live on.
 	// Leave this out entirely to use the workers.dev subdomain instead.
 	// "routes": [{ "pattern": "links.example.com", "custom_domain": true }],
+	//
+	// t.nutfes.net is attached to this Worker as a Custom Domain in the Cloudflare
+	// dashboard, not here — declaring it in both places is how you get a deploy
+	// that fights the dashboard. It is the host printed into QR codes; see
+	// VITE_FWD_BASE_URL in packages/web/.env.production for why (20 characters
+	// against 50, which is 37x37 modules instead of 49x49).
+	//
+	// Do not disable the workers.dev subdomain. QR codes printed before the custom
+	// domain existed carry it, and both hostnames have to keep resolving for as
+	// long as that paper is on a wall.
 	// Rate limiter for POST /auth/login. `unsafe` bindings are excluded from
 	// `wrangler types`, so the interface is declared by hand in src/auth/types.ts.
 	// The limiter is per-colo, not global — plenty for an admin panel.
diff --git a/packages/web/.env.example b/packages/web/.env.example
index 178109f..2755e44 100644
--- a/packages/web/.env.example
+++ b/packages/web/.env.example
@@ -1,6 +1,11 @@
 # Copy to `.env.local` for local development.
 VITE_API_URL=http://localhost:8789
 
-# Optional: base URL encoded into generated QR codes, if it should differ
-# from VITE_API_URL (e.g. a custom domain in front of the same Worker).
-# VITE_FWD_BASE_URL=https://links.example.com
+# Optional: base URL encoded into generated QR codes, if it should differ from
+# VITE_API_URL (a short custom domain in front of the same Worker). Every
+# character here is printed into every QR code, so a short host is worth more
+# than any other shortening — production uses https://t.nutfes.net.
+#
+# Leave it unset locally: QR codes then point at your local Worker, which is what
+# makes a scan testable without deploying.
+# VITE_FWD_BASE_URL=https://t.example.com
diff --git a/packages/web/.env.production b/packages/web/.env.production
index 44a11cc..c7e0104 100644
--- a/packages/web/.env.production
+++ b/packages/web/.env.production
@@ -1 +1,13 @@
 VITE_API_URL=https://trackinglink.nutfes-nutmeg9488.workers.dev
+
+# Domain baked into generated QR codes. Both hostnames reach the same Worker, so
+# this only changes what gets printed — https://t.nutfes.net is 20 characters
+# against the workers.dev subdomain's 50, which takes the printed symbol from
+# 49x49 modules down to 37x37 at the same error-correction level.
+#
+# The admin API deliberately stays on workers.dev: its URL length costs nothing,
+# and leaving it alone means ALLOWED_ORIGINS and the login session are untouched.
+#
+# workers.dev must stay enabled regardless — QR codes already printed carry that
+# hostname, and paper cannot be reissued.
+VITE_FWD_BASE_URL=https://t.nutfes.net