diff --git a/deploy.sh b/deploy.sh
index b6bda8c..4351724 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -26,10 +26,10 @@ else
 fi
 
 # Subdomain prefixes (hardcoded — change here if needed)
-APP_SUB="hub"
-DNS_SUB="noc"
-WWW_SUB="www"
-AUTH_SUB="auth"
+APP_SUB="app"
+DNS_SUB="dns"
+WWW_SUB=""
+AUTH_SUB=""
 
 # --- Mode detection ---
 GREENFIELD=false
@@ -103,11 +103,16 @@ if [ "$GREENFIELD" = true ]; then
     # Step 4: Run helper tool — port 80 is free, can obtain LE certs via HTTP-01
     echo "[4/6] Checking certificates..."
     mkdir -p "$BACKUP_DIR/certificates"
-    if [ -f "$TOOL_BIN" ]; then
+    # Build list of active subdomains (skip empty ones)
+    ALL_SUBS=""
+    for S in $APP_SUB $DNS_SUB $WWW_SUB; do
+        [ -n "$S" ] && ALL_SUBS="${ALL_SUBS:+$ALL_SUBS,}${S}.${DOMAIN}"
+    done
+    if [ -f "$TOOL_BIN" ] && [ -n "$ALL_SUBS" ]; then
         DRY=""
         [ "${LE_DRY_RUN:-false}" = "true" ] && DRY="--dry-run"
         "$TOOL_BIN" cert \
-            --domains "${APP_SUB}.${DOMAIN},${DNS_SUB}.${DOMAIN},${WWW_SUB}.${DOMAIN}" \
+            --domains "$ALL_SUBS" \
             --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
             --backup-dir "$BACKUP_DIR/certificates" $DRY 2>&1 || true
     fi
@@ -130,8 +135,9 @@ if [ "$GREENFIELD" = true ]; then
     fi
 
     # Copy certificates from backup vault to Zoraxy cert dir
-    for DOMAIN_SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
-        FQDN="${DOMAIN_SUB}.${DOMAIN}"
+    for S in $APP_SUB $DNS_SUB $WWW_SUB; do
+        [ -z "$S" ] && continue
+        FQDN="${S}.${DOMAIN}"
         CERT_SRC="$BACKUP_DIR/certificates/${FQDN}/fullchain.pem"
         KEY_SRC="$BACKUP_DIR/certificates/${FQDN}/privkey.pem"
         if [ -f "$CERT_SRC" ] && [ -f "$KEY_SRC" ]; then
@@ -186,15 +192,18 @@ EOF
     # Register certificates using Go tool (handles CSRF/session properly)
     echo "[*] Registering certificates via Go tool..."
     REG_TOOL="$REPO_DIR/tools/register-certs/register-certs"
-    if [ -f "$REG_TOOL" ]; then
-        cd "$REPO_DIR/tools/register-certs" && go build -o register-certs . 2>/dev/null && cd "$REPO_DIR"
-        "$REG_TOOL" "${ADMIN_USERNAME:-master}" "${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" \
-            ${APP_SUB}.${DOMAIN} ${DNS_SUB}.${DOMAIN} ${WWW_SUB}.${DOMAIN} 2>&1 || true
-    else
-        echo "  [WARN] Register tool not found, building..."
-        cd "$REPO_DIR/tools/register-certs"
-        go build -o register-certs . 2>&1 || true
-        cd "$REPO_DIR"
+    # Build list of domains
+    DOMAIN_LIST=""
+    for S in $APP_SUB $DNS_SUB $WWW_SUB; do
+        [ -n "$S" ] && DOMAIN_LIST="$DOMAIN_LIST ${S}.${DOMAIN}"
+    done
+    if [ -n "$DOMAIN_LIST" ]; then
+        if [ ! -f "$REG_TOOL" ]; then
+            cd "$REPO_DIR/tools/register-certs" && go build -o register-certs . 2>/dev/null && cd "$REPO_DIR"
+        fi
+        if [ -f "$REG_TOOL" ]; then
+            "$REG_TOOL" "${ADMIN_USERNAME:-master}" "${ADMIN_PASSWORD:-9Aku7MfklZU9ldnZ}" $DOMAIN_LIST 2>&1 || true
+        fi
     fi
 
     # Stop Zoraxy to write proxy configs
@@ -217,6 +226,7 @@ ZORAXY_APP
 }
 ZORAXY_DNS
 
+    if [ -n "$WWW_SUB" ]; then
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/${WWW_SUB}.$DOMAIN.config" <<ZORAXY_WWW
 {
     "ProxyType": 1,
@@ -225,7 +235,9 @@ ZORAXY_DNS
     "Disabled": false, "AuthenticationProvider": {"AuthMethod": 0}
 }
 ZORAXY_WWW
+    fi
 
+    if [ -n "$AUTH_SUB" ]; then
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/${AUTH_SUB}.$DOMAIN.config" <<ZORAXY_AUTH
 {
     "ProxyType": 1,
@@ -234,6 +246,7 @@ ZORAXY_WWW
     "Disabled": false, "AuthenticationProvider": {"AuthMethod": 0}
 }
 ZORAXY_AUTH
+    fi
 
     chattr -R +i "$TARGET_DIR/config/zoraxy/conf/proxy/" 2>/dev/null || true