diff --git a/packages/targets/deploy-ssh/bin/install.sh b/packages/targets/deploy-ssh/bin/install.sh
index 16818a41..e50484cc 100755
--- a/packages/targets/deploy-ssh/bin/install.sh
+++ b/packages/targets/deploy-ssh/bin/install.sh
@@ -25,7 +25,9 @@
 #   PORT           the app listens here, on loopback   (default: 3000)
 #   HEALTH_PATH    GET this until it answers 2xx/3xx   (default: /)
 #   HEALTH_TIMEOUT seconds                             (default: 120)
-#   DOMAINS        "example.com www.example.com": nginx site for them, none if empty
+#   DOMAINS        "example.com www.example.com": nginx site for them, none if empty.
+#                  The first is canonical: once TLS is up, every other name
+#                  (and plain http) answers 301 to https://<first>.
 #   TLS            1 | 0: Let's Encrypt via certbot    (default: 1)
 #   TLS_EMAIL      ACME account email                  (default: none)
 #   STATIC_DIR     RUNTIME=static: directory nginx serves (default: dist)
@@ -313,8 +315,9 @@ EOF
 }
 
 nginx_conf() {
-  local cert="$1" first
+  local cert="$1" first aliases
   first="${DOMAINS%% *}"
+  aliases="$(printf '%s' "${DOMAINS#"$first"}" | xargs)"
   local body
   if [ "$RUNTIME" = static ]; then
     local fallback='=404'
@@ -342,13 +345,26 @@ server {
     listen 80;
     listen [::]:80;
     server_name $DOMAINS;
-    return 301 https://\$host\$request_uri;
+    return 301 https://$first\$request_uri;
 }
+$( [ -n "$aliases" ] && cat <<ALIAS
 
+# One hostname per site: every other name (www.*) answers with a 301 to $first.
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
-    server_name $DOMAINS;
+    server_name $aliases;
+    ssl_certificate /etc/letsencrypt/live/$first/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/$first/privkey.pem;
+    return 301 https://$first\$request_uri;
+}
+ALIAS
+)
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name $first;
     ssl_certificate /etc/letsencrypt/live/$first/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/$first/privkey.pem;
     client_max_body_size $MAX_BODY;
@@ -387,7 +403,8 @@ write_nginx() {
   backup="$(mktemp)"
   $SUDO cat "$conf" > "$backup" 2>/dev/null || : > "$backup"
   CHANGED=0
-  nginx_conf "$cert" | put_root_file "$conf" 0644
+  # Not a pipe: put_root_file must run in this shell so CHANGED=1 survives.
+  put_root_file "$conf" 0644 < <(nginx_conf "$cert")
   [ -n "$link" ] && { $SUDO test -L "$link" || { $SUDO ln -sfn "$conf" "$link"; CHANGED=1; }; }
   if [ "$CHANGED" = 1 ]; then
     if ! $SUDO nginx -t >/dev/null 2>&1; then
@@ -407,7 +424,7 @@ write_nginx() {
     for d in $DOMAINS; do args+=(-d "$d"); done
     if [ -n "$TLS_EMAIL" ]; then args+=(-m "$TLS_EMAIL"); else args+=(--register-unsafely-without-email); fi
     if $SUDO certbot "${args[@]}"; then
-      nginx_conf 1 | put_root_file "$conf" 0644
+      put_root_file "$conf" 0644 < <(nginx_conf 1)
       $SUDO nginx -t && $SUDO systemctl reload nginx
       log "tls: certificate issued for $DOMAINS"
     else
diff --git a/packages/targets/deploy-ssh/package.json b/packages/targets/deploy-ssh/package.json
index 03605378..80baa3b7 100644
--- a/packages/targets/deploy-ssh/package.json
+++ b/packages/targets/deploy-ssh/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/sh1pt-target-deploy-ssh",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "main": "./src/index.ts",
   "scripts": {