diff --git a/checks/rabbi-gerzi-domains.nix b/checks/rabbi-gerzi-domains.nix
index c3fd6e0..27c9e62 100644
--- a/checks/rabbi-gerzi-domains.nix
+++ b/checks/rabbi-gerzi-domains.nix
@@ -9,8 +9,6 @@ let
   backendConfig = config.services.rabbi-gerzi.backend;
   frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName};
   backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName};
-  frontendCertificate = config.security.acme.certs.${frontendConfig.hostName};
-  backendCertificate = config.security.acme.certs.${backendConfig.hostName};
   redirectVirtualHost = lib.attrByPath [
     "www.rabbigerzi.com"
   ] { } config.services.nginx.virtualHosts;
@@ -36,24 +34,17 @@ let
       assertion =
         backendConfig.corsAllowedOrigins == [
           "https://rabbigerzi.com"
+          "https://rabbigerzi.yisroelbaum.com"
         ];
-      message = "Rabbi Gerzi CORS origins are not production-only";
+      message = "Rabbi Gerzi CORS origins do not cover production and staging";
     }
     {
-      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
-      message = "Rabbi Gerzi frontend still serves the staging alias";
+      assertion = builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
+      message = "Rabbi Gerzi frontend staging alias is missing";
     }
     {
-      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
-      message = "Rabbi Gerzi backend still serves the staging alias";
-    }
-    {
-      assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendCertificate.extraDomainNames;
-      message = "Rabbi Gerzi frontend certificate still covers staging";
-    }
-    {
-      assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendCertificate.extraDomainNames;
-      message = "Rabbi Gerzi backend certificate still covers staging";
+      assertion = builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
+      message = "Rabbi Gerzi backend staging alias is missing";
     }
     {
       assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";
diff --git a/rabbi-gerzi.nix b/rabbi-gerzi.nix
index 089916e..70fd980 100644
--- a/rabbi-gerzi.nix
+++ b/rabbi-gerzi.nix
@@ -15,14 +15,20 @@
       nginx = {
         forceSSL = true;
         enableACME = true;
+        serverAliases = [ "rabbigerzi.yisroelbaum.com" ];
       };
     };
     backend = {
       hostName = "api.rabbigerzi.com";
       environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
+      corsAllowedOrigins = [
+        "https://rabbigerzi.com"
+        "https://rabbigerzi.yisroelbaum.com"
+      ];
       nginx = {
         forceSSL = true;
         enableACME = true;
+        serverAliases = [ "rabbigerziapi.yisroelbaum.com" ];
       };
     };
   };