diff --git a/.well-known/security.txt b/.well-known/security.txt
index 89b2526e..ec20be40 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -5,5 +5,5 @@
 Contact: mailto:j.d.a.jewell@open.ac.uk
 Expires: 2027-12-31T23:59:59.000Z
 Preferred-Languages: en
-Canonical: https://boj-server.net/.well-known/security.txt
+Canonical: https://app.boj-server.net/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/boj-server/blob/main/SECURITY.md
diff --git a/docs/website/CLOUDFLARE-SETUP.adoc b/docs/website/CLOUDFLARE-SETUP.adoc
index 39cc8d1f..11985636 100644
--- a/docs/website/CLOUDFLARE-SETUP.adoc
+++ b/docs/website/CLOUDFLARE-SETUP.adoc
@@ -25,6 +25,23 @@ generated from the canonical registry.
 
 No framework, no Node/npm, no build command. Cloudflare serves `site/` as-is.
 
+== Current deployment — Workers + Assets on `app.boj-server.net` (2026-10-09)
+
+The site now deploys as a Worker with static assets (`wrangler.toml`), pushed by
+`.github/workflows/pages-deploy.yml` on every push to `main`. The hostname is bound in
+`wrangler.toml` as a `[[routes]]` entry with `custom_domain = true`, so no dashboard
+step attaches it. `app.boj-server.net` had no DNS record, so the first deploy creates
+one. The apex `boj-server.net` is deliberately left alone, for an outer site that
+links here.
+
+Do not change that `pattern` to the apex, or to any hostname that already has a DNS
+record, without noting the existing record first. In a non-interactive run (CI),
+wrangler sets `override_existing_dns_record` and `override_existing_origin` to `true`
+without prompting, so the existing record is replaced silently.
+
+The sections below describe the earlier Cloudflare Pages path and are kept for
+reference.
+
 == Go-live path A — Dashboard Git-connect (recommended, chosen)
 
 `boj-server.net` is already a zone in the Cloudflare account, so this is a one-time,
@@ -96,9 +113,9 @@ the dashboard auto-creates the DNS records.
 
 [source,bash]
 ----
-curl -sSI https://boj-server.net | grep -iE 'strict-transport|content-security|x-content-type'
-curl -sS  https://boj-server.net/catalog.json | jq '.cartridges | length'   # -> 139
-curl -sSI https://boj-server.net/.well-known/security.txt
+curl -sSI https://app.boj-server.net | grep -iE 'strict-transport|content-security|x-content-type'
+curl -sS  https://app.boj-server.net/catalog.json | jq '.cartridges | length'   # -> 139
+curl -sSI https://app.boj-server.net/.well-known/security.txt
 ----
 
 == Regenerate the catalogue snapshot
diff --git a/site/.well-known/security.txt b/site/.well-known/security.txt
index 89b2526e..ec20be40 100644
--- a/site/.well-known/security.txt
+++ b/site/.well-known/security.txt
@@ -5,5 +5,5 @@
 Contact: mailto:j.d.a.jewell@open.ac.uk
 Expires: 2027-12-31T23:59:59.000Z
 Preferred-Languages: en
-Canonical: https://boj-server.net/.well-known/security.txt
+Canonical: https://app.boj-server.net/.well-known/security.txt
 Policy: https://github.com/hyperpolymath/boj-server/blob/main/SECURITY.md
diff --git a/site/index.html b/site/index.html
index 277d83b8..5c6e2995 100644
--- a/site/index.html
+++ b/site/index.html
@@ -10,12 +10,12 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>boj-server — one MCP endpoint for all your tooling</title>
   <meta name="description" content="Bundle of Joy (BoJ) is a unified MCP server consolidating GitHub, GitLab, Cloudflare, Vercel, Gmail, browser automation, research, ML and 139 open-source cartridges into a single endpoint. Configure your install and browse the cartridge catalogue.">
-  <link rel="canonical" href="https://boj-server.net/">
+  <link rel="canonical" href="https://app.boj-server.net/">
   <meta property="og:type" content="website">
   <meta property="og:title" content="boj-server — one MCP endpoint for all your tooling">
   <meta property="og:description" content="Configure a BoJ install (base + NeSy / Agentic / Coordination bundles) and browse 139 open-source MCP cartridges.">
-  <meta property="og:url" content="https://boj-server.net/">
-  <meta property="og:image" content="https://boj-server.net/assets/social-preview.png">
+  <meta property="og:url" content="https://app.boj-server.net/">
+  <meta property="og:image" content="https://app.boj-server.net/assets/social-preview.png">
   <meta property="og:image:width" content="1280">
   <meta property="og:image:height" content="640">
   <meta property="og:image:alt" content="BoJ Server mark: braces around a stack of cartridges">
diff --git a/site/robots.txt b/site/robots.txt
index 8522ca99..488c3e75 100644
--- a/site/robots.txt
+++ b/site/robots.txt
@@ -2,4 +2,4 @@
 User-agent: *
 Allow: /
 
-Sitemap: https://boj-server.net/sitemap.xml
+Sitemap: https://app.boj-server.net/sitemap.xml
diff --git a/site/sitemap.xml b/site/sitemap.xml
index d66b2b61..88d548ff 100644
--- a/site/sitemap.xml
+++ b/site/sitemap.xml
@@ -2,7 +2,7 @@
 <!-- SPDX-License-Identifier: MPL-2.0 -->
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   <url>
-    <loc>https://boj-server.net/</loc>
+    <loc>https://app.boj-server.net/</loc>
     <lastmod>2026-06-24</lastmod>
     <changefreq>weekly</changefreq>
     <priority>1.0</priority>
diff --git a/wrangler.toml b/wrangler.toml
index f16080eb..c8c30c5a 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -16,3 +16,13 @@ directory = "site"
 
 [build]
 command = ""
+
+# Serve the site on app.boj-server.net. The apex is left for an outer site that
+# will link to this one (owner decision, 2026-10-09). A fresh hostname has no DNS
+# record, so the deploy creates one. That matters because, in a non-TTY run such
+# as CI, wrangler sets override_existing_dns_record = true without prompting
+# (deploy-helpers/src/triggers/publish-routes.ts). Pointed at the apex, it would
+# silently replace the existing apex record.
+[[routes]]
+pattern = "app.boj-server.net"
+custom_domain = true