diff --git a/ansible/playbooks/roles/traefik/handlers/main.yml b/ansible/playbooks/roles/traefik/handlers/main.yml
index cc9292c..27915ea 100644
--- a/ansible/playbooks/roles/traefik/handlers/main.yml
+++ b/ansible/playbooks/roles/traefik/handlers/main.yml
@@ -5,4 +5,5 @@
 - name: restart traefik
   community.docker.docker_compose_v2:
     project_src: "{{ traefik_base_dir }}"
-    state: restarted
+    state: present
+    recreate: always
diff --git a/boilerplates/nextcloud/compose.yml b/boilerplates/nextcloud/compose.yml
index 539fcab..bdafef9 100644
--- a/boilerplates/nextcloud/compose.yml
+++ b/boilerplates/nextcloud/compose.yml
@@ -79,6 +79,7 @@ services:
       - APACHE_SERVER_NAME=the-grid.local.mk-labs.cloud
       # Reverse proxy — lightning-lane IP only
       - TRUSTED_PROXIES=10.1.71.35
+      - SKIP_DOMAIN_VALIDATION=true
       - OVERWRITEPROTOCOL=https
       - OVERWRITECLIURL=https://the-grid.mk-labs.cloud
     networks:
diff --git a/boilerplates/traefik/compose.yaml b/boilerplates/traefik/compose.yaml
index a9c966e..fa20353 100644
--- a/boilerplates/traefik/compose.yaml
+++ b/boilerplates/traefik/compose.yaml
@@ -24,6 +24,8 @@ services:
       - "--entrypoints.websecure.http.tls.certResolver=cloudflare"
       - "--entrypoints.websecure.http.tls.domains[0].main=local.mk-labs.cloud"
       - "--entrypoints.websecure.http.tls.domains[0].sans=*.local.mk-labs.cloud"
+      - "--entrypoints.websecure.http.tls.domains[1].main=mk-labs.cloud"
+      - "--entrypoints.websecure.http.tls.domains[1].sans=*.mk-labs.cloud"
       # ACME / Cloudflare DNS-01
       - "--certificatesresolvers.cloudflare.acme.email=ryan.blundon@protonmail.com"
       - "--certificatesresolvers.cloudflare.acme.storage=/var/traefik/certs/acme.json"
diff --git a/boilerplates/traefik/dynamic/nextcloud.yml b/boilerplates/traefik/dynamic/nextcloud.yml
index 50f464a..65ee9ce 100644
--- a/boilerplates/traefik/dynamic/nextcloud.yml
+++ b/boilerplates/traefik/dynamic/nextcloud.yml
@@ -1,7 +1,7 @@
 http:
   routers:
     nextcloud:
-      rule: "Host(`nextcloud.local.mk-labs.cloud`) || Host(`the-grid.local.mk-labs.cloud`)"
+      rule: "Host(`nextcloud.local.mk-labs.cloud`) || Host(`the-grid.local.mk-labs.cloud`) || Host(`the-grid.mk-labs.cloud`)"
       entryPoints:
         - websecure
       tls:
@@ -21,4 +21,4 @@ http:
     nextcloud:
       loadBalancer:
         servers:
-          - url: "http://the-grid.local.mk-labs.cloud:80"
+          - url: "http://10.1.71.128:80"