diff --git a/checks/rabbi-gerzi-domains.nix b/checks/rabbi-gerzi-domains.nix
index 27c9e62..c3fd6e0 100644
--- a/checks/rabbi-gerzi-domains.nix
+++ b/checks/rabbi-gerzi-domains.nix
@@ -9,6 +9,8 @@ let
   backendConfig = config.services.rabbi-gerzi.backend;
   frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName};
   backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName};
+  frontendCertificate = config.security.acme.certs.${frontendConfig.hostName};
+  backendCertificate = config.security.acme.certs.${backendConfig.hostName};
   redirectVirtualHost = lib.attrByPath [
     "www.rabbigerzi.com"
   ] { } config.services.nginx.virtualHosts;
@@ -34,17 +36,24 @@ let
       assertion =
         backendConfig.corsAllowedOrigins == [
           "https://rabbigerzi.com"
-          "https://rabbigerzi.yisroelbaum.com"
         ];
-      message = "Rabbi Gerzi CORS origins do not cover production and staging";
+      message = "Rabbi Gerzi CORS origins are not production-only";
     }
     {
-      assertion = builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
-      message = "Rabbi Gerzi frontend staging alias is missing";
+      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
+      message = "Rabbi Gerzi frontend still serves the staging alias";
     }
     {
-      assertion = builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
-      message = "Rabbi Gerzi backend staging alias is missing";
+      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
+      message = "Rabbi Gerzi backend still serves the staging alias";
+    }
+    {
+      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendCertificate.extraDomainNames;
+      message = "Rabbi Gerzi frontend certificate still covers staging";
+    }
+    {
+      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendCertificate.extraDomainNames;
+      message = "Rabbi Gerzi backend certificate still covers staging";
     }
     {
       assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";
diff --git a/rabbi-gerzi.nix b/rabbi-gerzi.nix
index 70fd980..089916e 100644
--- a/rabbi-gerzi.nix
+++ b/rabbi-gerzi.nix
@@ -15,20 +15,14 @@
       nginx = {
         forceSSL = true;
         enableACME = true;
-        serverAliases = [ "rabbigerzi.yisroelbaum.com" ];
       };
     };
     backend = {
       hostName = "api.rabbigerzi.com";
       environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
-      corsAllowedOrigins = [
-        "https://rabbigerzi.com"
-        "https://rabbigerzi.yisroelbaum.com"
-      ];
       nginx = {
         forceSSL = true;
         enableACME = true;
-        serverAliases = [ "rabbigerziapi.yisroelbaum.com" ];
       };
     };
   };