diff --git a/hosts/hopper/profiles/lab/acme.nix b/hosts/hopper/profiles/lab/acme.nix
index 3e38cca..d124e9c 100644
--- a/hosts/hopper/profiles/lab/acme.nix
+++ b/hosts/hopper/profiles/lab/acme.nix
@@ -11,7 +11,7 @@ in {
     certs = {
       "${domain}" = {
         domain = "${domain}";
-        extraDomainNames = ["*.${domain}" "*.hopper.priv.${domain}"];
+        extraDomainNames = ["*.${domain}" "*.hopper.priv.${domain}" "*.s3-web.hopper.priv.${domain}"];
         dnsProvider = "cloudflare";
         reloadServices = ["caddy.service"];
         credentialFiles = {
diff --git a/hosts/hopper/profiles/lab/caddy.nix b/hosts/hopper/profiles/lab/caddy.nix
index 70be7dc..a837c46 100644
--- a/hosts/hopper/profiles/lab/caddy.nix
+++ b/hosts/hopper/profiles/lab/caddy.nix
@@ -61,6 +61,7 @@ in {
       glances = mkPrivateEntry "glances" "${bridge}:${toString config.services.glances.port}";
       alertmanager = mkPrivateEntry "alerts" "${bridge}:${toString config.services.prometheus.alertmanager.port}";
       s3-web = mkPrivateEntry "s3-web" "unix//run/garage/web.sock";
+      s3-web2 = mkPrivateEntry "*.s3-web" "unix//run/garage/web.sock";
 
       other = {
         hostName = "*.${domain}:80";
diff --git a/hosts/hopper/profiles/lab/garage.nix b/hosts/hopper/profiles/lab/garage.nix
index 75298e8..96a65e4 100644
--- a/hosts/hopper/profiles/lab/garage.nix
+++ b/hosts/hopper/profiles/lab/garage.nix
@@ -21,7 +21,7 @@
 
       s3_web = {
         bind_addr = "/run/garage/web.sock";
-        root_domain = "s3-web.hopper.priv.${vars.domain}";
+        root_domain = ".s3-web.hopper.priv.${vars.domain}";
       };
     };
   };