diff --git a/nixos/machines/railbird-sf.nix b/nixos/machines/railbird-sf.nix
index 94d4147b..d220ad49 100644
--- a/nixos/machines/railbird-sf.nix
+++ b/nixos/machines/railbird-sf.nix
@@ -101,7 +101,6 @@
   services.nginx.virtualHosts."rocket-sense.duckdns.org" = {
     enableACME = true;
     forceSSL = true;
-    serverAliases = ["rbsf.tplinkdns.com"];
     locations."/" = {
       proxyPass = "http://127.0.0.1:30080";
       proxyWebsockets = true;
@@ -113,6 +112,14 @@
     };
   };
 
+  services.nginx.virtualHosts."rbsf.tplinkdns.com" = {
+    useACMEHost = "rocket-sense.duckdns.org";
+    forceSSL = true;
+    globalRedirect = "rocket-sense.duckdns.org";
+  };
+
+  security.acme.certs."rocket-sense.duckdns.org".extraDomainNames = ["rbsf.tplinkdns.com"];
+
   # Open the standard Syncthing sync/discovery ports on the host firewall.
   # Note: you may still need router/NAT port-forwards for inbound access from the internet.
   services.syncthing.openDefaultPorts = true;