diff --git a/deploy/nomad/README.md b/deploy/nomad/README.md
index 90e7d9d..6e70048 100644
--- a/deploy/nomad/README.md
+++ b/deploy/nomad/README.md
@@ -86,7 +86,7 @@ sudo cp deploy/nomad/nomad.hcl /etc/nomad.d/nomad.hcl
 
 The API is reachable from the internet (Forgejo runner → VPS), so TLS is
 mandatory. Use the script (CA + server cert with all required SANs in one
-shot — hand-rolled openssl commands tend to miss `server.global.vps.nomad`,
+shot — hand-rolled openssl commands tend to miss `server.global.nomad`,
 which `verify_server_hostname` requires):
 
 ```bash
@@ -107,10 +107,10 @@ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
 # server cert — SANs must cover the RPC hostname AND how clients reach it
 openssl req -newkey rsa:2048 -nodes \
   -keyout server.key -out server.csr \
-  -subj "/CN=server.global.vps.nomad"
+  -subj "/CN=server.global.nomad"
 
 cat > server.ext <<'EOF'
-subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:<VPS_PUBLIC_IP>
+subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:<VPS_PUBLIC_IP>
 extendedKeyUsage = serverAuth, clientAuth
 EOF
 
diff --git a/deploy/nomad/gen-tls.sh b/deploy/nomad/gen-tls.sh
index ea67d4a..7eff780 100644
--- a/deploy/nomad/gen-tls.sh
+++ b/deploy/nomad/gen-tls.sh
@@ -24,13 +24,15 @@ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
   -keyout nomad-ca.key -out nomad-ca.crt \
   -subj "/CN=Contract-Check Nomad CA"
 
-# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles)
+# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles).
+#    With verify_server_hostname=true the RPC name is server.<REGION>.nomad
+#    (NOT server.<region>.<dc>.nomad) — region here is "global" (nomad.hcl).
 openssl req -newkey rsa:2048 -nodes \
   -keyout server.key -out server.csr \
-  -subj "/CN=server.global.vps.nomad"
+  -subj "/CN=server.global.nomad"
 
 cat > server.ext <<EOF
-subjectAltName = DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
+subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
 extendedKeyUsage = serverAuth, clientAuth
 EOF
 
diff --git a/deploy/nomad/nomad.hcl b/deploy/nomad/nomad.hcl
index 8e462ce..adae33b 100644
--- a/deploy/nomad/nomad.hcl
+++ b/deploy/nomad/nomad.hcl
@@ -25,8 +25,8 @@ tls {
   cert_file = "/etc/nomad.d/tls/server.crt"
   key_file  = "/etc/nomad.d/tls/server.key"
 
-  # Requires the server cert SAN to carry server.global.vps.nomad
-  # (region.region/datacenter convention) — the README cert command adds it.
+  # RPC cert-name convention is server.<region>.nomad (see gen-tls.sh);
+  # the generated SAN list covers both region and region.dc forms.
   verify_server_hostname = true
 }