diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md
index 2aefe38..b2c3645 100644
--- a/deploy/nginx/README.md
+++ b/deploy/nginx/README.md
@@ -121,15 +121,26 @@ do not own.
 Deployed environments present certificates the server already holds. This box
 needs exactly two:
 
-|                     |                                                 |
-| ------------------- | ----------------------------------------------- |
-| `beta.reactome.org` | the site                                        |
-| `dev.reactome.org`  | the retired host, so its 503 is not a TLS error |
-
-and eventually only one, when the Angular site is the one going forward. The
-wikis live on the release machine; `login.dev` is gone. The `reactome.org`
-certificate here is presented only because the retired vhost lists that name as
-an alias — production serves it.
+|                     |                                                             |
+| ------------------- | ----------------------------------------------------------- |
+| `beta.reactome.org` | the site                                                    |
+| `dev.reactome.org`  | the retired host, so its 503 is not a TLS error             |
+| `reactome.org`      | the same, for the two aliases the retired vhost answers for |
+
+The wikis lived here as leftovers and were deleted on 2026-09-16, along with the
+long-expired `login.dev`.
+
+The third is easy to talk yourself out of. Production serves `reactome.org`, so
+it is tempting to drop the certificate — but this box still _answers_ for that
+name and for `www`, because the retired vhost lists them as aliases. Drop the
+certificate and those names get beta's instead: a name mismatch, so a browser
+security warning where there is currently a clean 503. A worse retirement than
+the one being replaced.
+
+So all three certificates must renew without Apache before the cutover, not two.
+`reactome.org` was still on the apache authenticator after the first migration
+pass — worth checking rather than assuming, since the script only moves what it
+is told to.
 
 ## Before any of this serves traffic
 
diff --git a/deploy/nginx/dev.conf b/deploy/nginx/dev.conf
index 6dde7fa..d359634 100644
--- a/deploy/nginx/dev.conf
+++ b/deploy/nginx/dev.conf
@@ -98,6 +98,29 @@ server {
     return 503;
 }
 
+# reactome.org and www.reactome.org, if anything points them here.
+#
+# Production serves these names. This box answers for them only because the
+# retired Apache vhost lists them as aliases, and it presents the reactome.org
+# certificate when it does. Without this block they would fall to the catch-all
+# below and be shown *beta's* certificate -- a name mismatch, so a browser
+# security warning where Apache gives a clean 503. That is a worse retirement
+# than the one being replaced.
+#
+# The certificate must therefore keep existing and keep renewing. It renewed via
+# the apache authenticator until 2026-09-16; moving it to dns-cloudflare is part
+# of the cutover, not optional, because after the cutover there is no Apache for
+# it to authenticate through.
+server {
+    listen 80;
+    listen 443 ssl;
+    server_name reactome.org www.reactome.org;
+    ssl_certificate     /etc/letsencrypt/live/reactome.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/reactome.org/privkey.pem;
+    include             /etc/nginx/common/tls.conf;
+    return 503;
+}
+
 # Anything else pointed at this box.
 #
 # A name we do not serve cannot be answered without a certificate mismatch