diff --git a/DEPLOY.md b/DEPLOY.md
index b965d6c..b2e239c 100644
--- a/DEPLOY.md
+++ b/DEPLOY.md
@@ -18,6 +18,8 @@ The node connects outbound over HTTPS, verifies the registry with the pinned MA
 
 ## Joining the network (membership site + wizard)
 
+The apex (`federatedsearch.org`) proxies the same membership page; `ma.` is the service host.
+
 Identity registration stays with the MA; the wizard only consumes the credentials it issues.
 
 MA operator — run the signup site:
@@ -45,9 +47,17 @@ Run `frxd` on loopback and terminate TLS with Caddy:
 caddy reverse-proxy --from relay.federatedsearch.org --to 127.0.0.1:7700
 ```
 
-Caddyfile equivalent:
+Caddyfile equivalent (apex is the public front door, `ma.` the membership service, `relay.` the relay — all on one host):
 
 ```
+federatedsearch.org {
+    reverse_proxy 127.0.0.1:7800
+}
+
+ma.federatedsearch.org {
+    reverse_proxy 127.0.0.1:7800
+}
+
 relay.federatedsearch.org {
     reverse_proxy 127.0.0.1:7700
 }