diff --git a/.env.example b/.env.example
index 2cf10edb..34a0dabb 100644
--- a/.env.example
+++ b/.env.example
@@ -21,13 +21,25 @@ WORKOS_CLIENT_ID=client_...
 WORKOS_API_KEY=sk_...
 # Session-cookie encryption key, >= 32 chars.
 WORKOS_COOKIE_PASSWORD=
-# Optional. Defaults to api.workos.com; set to api.identity.nyuchi.com to
-# route WorkOS API calls through the Nyuchi custom API domain. (The hosted
-# AuthKit sign-in UI is served separately from identity.nyuchi.com, configured
-# in the WorkOS dashboard — not via this variable.)
-WORKOS_API_HOSTNAME=api.identity.nyuchi.com
+# Optional. Defaults to api.workos.com; set to auth.mukoko.com to route WorkOS
+# API calls — and the bearer-token verifier's JWKS fetch — through the custom
+# API domain. This is the WorkOS *auth API*, NOT the authorization server:
+# auth.mukoko.com serves no authorization-server metadata, so pointing issuer
+# discovery at it dead-ends. The hosted AuthKit sign-in UI is a different host
+# again (see WORKOS_AUTHKIT_DOMAIN below).
+# Was api.identity.nyuchi.com before the Aug 2026 migration; that host no
+# longer resolves, so a stale value fails at the code exchange.
+WORKOS_API_HOSTNAME=auth.mukoko.com
+# Optional. The hosted AuthKit domain — the OAuth 2.1 authorization server MCP
+# clients discover (/oauth2/{authorize,token,register,jwks}, DCR enabled), and
+# what every .well-known/* route and /auth.md advertises. Code default is
+# accounts.mukoko.com; override per environment. WORKOS_ISSUER is accepted as
+# the preferred spelling. Also formerly identity.nyuchi.com — now dead DNS.
+WORKOS_AUTHKIT_DOMAIN=accounts.mukoko.com
 # Usually ${NEXT_PUBLIC_SITE_URL}/callback. The NEXT_PUBLIC_ prefix is required.
-NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://nhimbe.com/callback
+# Both production origins have a /callback registered in WorkOS; this points at
+# the primary one, matching NEXT_PUBLIC_SITE_URL below.
+NEXT_PUBLIC_WORKOS_REDIRECT_URI=https://events.mukoko.com/callback
 # Signing secret for the WorkOS event webhook (POST /api/webhooks/workos) —
 # guaranteed user provisioning (user.* → identity.persons,
 # organization_membership.* → entity.memberships). Copy it from the webhook
@@ -49,7 +61,14 @@ SHAMWARI_AI_GATEWAY_AUTH_TOKEN=
 RESEND_API_KEY=
 
 # --- Public site config ----------------------------------------------------
-NEXT_PUBLIC_SITE_URL=https://nhimbe.com
+# The PRIMARY/canonical origin, not merely "a" domain the app answers on.
+# Production is dual-domain (nhimbe.com + events.mukoko.com both serve the app),
+# but every self-referential URL — canonical tags, OG/Twitter images,
+# sitemap.xml, robots.txt, JSON-LD, the .well-known OAuth `resource` — is
+# consolidated onto this one origin so SEO signals don't split across both.
+# Matches the code default in src/lib/site-url.ts; setting it to nhimbe.com
+# instead would repoint all of those at the secondary domain.
+NEXT_PUBLIC_SITE_URL=https://events.mukoko.com
 # Maps + address search run on OpenStreetMap: Leaflet renders key-less OSM
 # tiles client-side, and geocoding is DB-first (places.places) then OSM
 # Nominatim (nominatim.openstreetmap.org) server-side — no Maps API key needed.