diff --git a/src/gateway/public-gateway.mjs b/src/gateway/public-gateway.mjs
index aa63bcd..05c3731 100644
--- a/src/gateway/public-gateway.mjs
+++ b/src/gateway/public-gateway.mjs
@@ -257,7 +257,22 @@ async function activeListings() {
   return keep;
 }
 const S3_ENDPOINT = process.env.BNS_S3 || "http://127.0.0.1:8500";
-const SUB_BASE = (process.env.BNS_SUB_BASE || "bch.navigate.st").toLowerCase(); // subdomain suffix
+// Primary subdomain suffix — new URLs (banner "Isolated view" link, OG
+// hints, etc.) are built against this. Flip to "bns.navigate.st" once the
+// wildcard cert is issued; "bch.navigate.st" remains the current default
+// so no cutover is required.
+const SUB_BASE = (process.env.BNS_SUB_BASE || "bch.navigate.st").toLowerCase();
+// Every suffix the inbound-matching accepts. "bch.navigate.st" was the
+// original and stays live for the ~6-month deprecation window; "bns.
+// navigate.st" is the renamed form (BNS = Bitcoin Cash Name Service, the
+// actual protocol name, instead of the misleading .bch segment on
+// non-.bch names like sirius-x.bch.navigate.st). Both decode through the
+// same subdomainLabelToName.
+const SUB_BASE_ALL = Array.from(new Set([
+  SUB_BASE,
+  ...(process.env.BNS_SUB_BASE_LEGACY || "bch.navigate.st,bns.navigate.st")
+    .toLowerCase().split(",").map((s) => s.trim()).filter(Boolean),
+]));
 
 // ---------- VPN exit catalogue + session leases ----------
 // The pool file holds, per exit, the Reality parameters a client needs AND a
@@ -2500,8 +2515,9 @@ const server = http.createServer(async (req, res) => {
     // Legacy form (back-compat): a dot-less single label implicitly meant
     // "<label>.bch" — `hello.bch.navigate.st` used to resolve "hello.bch".
     // We preserve that so existing bookmarks keep working.
-    if (hostHeader.endsWith("." + SUB_BASE)) {
-      const inner = hostHeader.slice(0, -("." + SUB_BASE).length);
+    const matchedBase = SUB_BASE_ALL.find((b) => hostHeader.endsWith("." + b));
+    if (matchedBase) {
+      const inner = hostHeader.slice(0, -("." + matchedBase).length);
       if (inner) {
         let name = subdomainLabelToName(inner).toLowerCase();
         if (!name.includes(".") && /^[a-z0-9-]+$/i.test(name)) {
@@ -2515,8 +2531,8 @@ const server = http.createServer(async (req, res) => {
         }
       }
     }
-    // bare apex of SUB_BASE (e.g. bch.navigate.st) -> home
-    if (hostHeader === SUB_BASE) { res.writeHead(200, { "content-type": "text/html" }); return res.end(home()); }
+    // bare apex of any accepted SUB_BASE -> home
+    if (SUB_BASE_ALL.includes(hostHeader)) { res.writeHead(200, { "content-type": "text/html" }); return res.end(home()); }
 
     // --- path form: /bns/<name>.bch/... ---
     let p = req.url;