diff --git a/deploy/nomad/README.md b/deploy/nomad/README.md
index 3b72be3..2c8d86c 100644
--- a/deploy/nomad/README.md
+++ b/deploy/nomad/README.md
@@ -82,9 +82,18 @@ sudo cp deploy/nomad/nomad.hcl /etc/nomad.d/nomad.hcl
 ## 3. Generate TLS material
 
 The API is reachable from the internet (Forgejo runner → VPS), so TLS is
-mandatory. One mini-CA + one server cert; the runner gets **only** the CA
-cert.
+mandatory. Use the script (CA + server cert with all required SANs in one
+shot — hand-rolled openssl commands tend to miss `server.global.vps.nomad`,
+which `verify_server_hostname` requires):
 
+```bash
+sudo deploy/nomad/gen-tls.sh <VPS_PUBLIC_IP>
+sudo systemctl restart nomad
+```
+
+The runner gets **only** the CA cert (`nomad-ca.crt`) as `NOMAD_CACERT`.
+
+Manual equivalent (what the script does):
 ```bash
 cd /tmp && mkdir nomad-tls && cd nomad-tls
 
diff --git a/deploy/nomad/gen-tls.sh b/deploy/nomad/gen-tls.sh
new file mode 100644
index 0000000..ea67d4a
--- /dev/null
+++ b/deploy/nomad/gen-tls.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Regenerate Nomad TLS material for the single-node agent.
+#
+# Usage (on the services VPS, from the repo root):
+#   sudo deploy/nomad/gen-tls.sh <VPS_PUBLIC_IP>
+#
+# Produces /etc/nomad.d/tls/{nomad-ca.crt, server.crt, server.key} and leaves
+# the new CA in a temp dir for copying to the Forgejo runner (NOMAD_CACERT).
+# Requirements: SAN must contain server.global.vps.nomad (region.global,
+# datacenter vps — matches deploy/nomad/nomad.hcl) + the addresses clients
+# use to reach the API.
+
+set -euo pipefail
+
+ip="${1:?usage: gen-tls.sh <VPS_PUBLIC_IP>}"
+
+tls_dir=/etc/nomad.d/tls
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+cd "$work"
+
+# 1. mini CA
+openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+  -keyout nomad-ca.key -out nomad-ca.crt \
+  -subj "/CN=Contract-Check Nomad CA"
+
+# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles)
+openssl req -newkey rsa:2048 -nodes \
+  -keyout server.key -out server.csr \
+  -subj "/CN=server.global.vps.nomad"
+
+cat > server.ext <<EOF
+subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
+extendedKeyUsage = serverAuth, clientAuth
+EOF
+
+openssl x509 -req -in server.csr \
+  -CA nomad-ca.crt -CAkey nomad-ca.key -CAcreateserial \
+  -out server.crt -days 825 -extfile server.ext
+
+# 3. self-check before installing
+openssl verify -CAfile nomad-ca.crt server.crt
+openssl x509 -in server.crt -noout -ext subjectAltName
+
+# 4. install
+install -d -m 755 "$tls_dir"
+install -m 644 nomad-ca.crt server.crt "$tls_dir/"
+install -m 600 server.key "$tls_dir/"
+
+cat <<EOF
+
+OK. Now:
+  1. systemctl restart nomad && journalctl -u nomad -f   (handshake errors should stop)
+  2. export NOMAD_ADDR=https://127.0.0.1:4646 NOMAD_CACERT=$tls_dir/nomad-ca.crt
+  3. nomad server members && nomad node status
+  4. copy $tls_dir/nomad-ca.crt to the Forgejo repo secret NOMAD_CACERT
+     (runner verifies the server with it; the CA key never leaves this host)
+EOF