diff --git a/infra/PROD-STANDUP.md b/infra/PROD-STANDUP.md
index 61c4208..d9a342c 100644
--- a/infra/PROD-STANDUP.md
+++ b/infra/PROD-STANDUP.md
@@ -231,13 +231,30 @@ timeout 3600 infra/devcontainer/dev.sh run bootstrap/standup.sh \
 | Published DNS | **36 records** under `prod.home.keithjackson.dev`, every TXT registry entry `owner=prod` |
 | Dev's records | **57, byte-identical to the pre-standup baseline — nothing added, changed or removed** |
 
-End-to-end HTTPS, certificate validated (no `-k`), pinned to prod's gateway:
+End-to-end HTTPS **through the workstation's own resolver — no `--resolve` override, no `-k`** (after
+installing the dnsmasq profile below). Every request landed on `192.168.2.20`:
 
 ```
-prod.home.keithjackson.dev            200     keycloak.…  302 (login redirect)
-gitea.prod.home.keithjackson.dev      200     grafana.…   302 (SSO redirect)
+prod.home.keithjackson.dev  200   headlamp.  200   keycloak.  302 (login)   nextcloud. 302
+gitea.       200            semaphore. 200        grafana.   302 (SSO)      pihole.    302
 ```
 
+The served certificate is prod's own, confirmed by SNI — **not** dev's wildcard, which is what the
+resolver bug previously made it look like:
+
+```
+subject = CN=*.prod.home.keithjackson.dev
+issuer  = C=US, O=Let's Encrypt, CN=YR1          (LE production)
+SAN     = *.prod.home.keithjackson.dev, prod.home.keithjackson.dev
+valid   = 2026-09-05 .. 2026-12-04
+```
+
+Dev, checked in the same pass, still serves `CN=*.home.keithjackson.dev` — **unchanged**.
+
+> Ignore `curl: (91) No OCSP response received` if you pass `--cert-status`: Let's Encrypt retired
+> OCSP responders in 2025, so there is nothing to staple. It is not a certificate fault, and the plain
+> requests above all validated normally.
+
 ### Workstation DNS — install the prod dnsmasq profile
 
 **CORRECTION (operator, 2026-09-05): this is the workstation's own dnsmasq, NOT pfSense.** Earlier