diff --git a/deploy.sh b/deploy.sh
index a82d241..258a1bf 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -25,6 +25,12 @@ else
     DOMAIN="${DOMAIN:-nextwks.eu}"
 fi
 
+# Subdomain prefixes (override via .env: APP_SUBDOMAIN=hub DNS_SUBDOMAIN=noc)
+APP_SUB="${APP_SUBDOMAIN:-app}"
+DNS_SUB="${DNS_SUBDOMAIN:-dns}"
+WWW_SUB="${WWW_SUBDOMAIN:-www}"
+AUTH_SUB="${AUTH_SUBDOMAIN:-auth}"
+
 # --- Mode detection ---
 GREENFIELD=false
 if [ "${1:-}" = "--destroy" ]; then
@@ -99,7 +105,7 @@ if [ "$GREENFIELD" = true ]; then
     mkdir -p "$BACKUP_DIR/certificates"
     if [ -f "$TOOL_BIN" ]; then
         "$TOOL_BIN" cert \
-            --domains "app.${DOMAIN},dns.${DOMAIN},www.${DOMAIN}" \
+            --domains "${APP_SUB}.${DOMAIN},${DNS_SUB}.${DOMAIN},${WWW_SUB}.${DOMAIN}" \
             --email "${TLS_EMAIL:-admin@${DOMAIN}}" \
             --backup-dir "$BACKUP_DIR/certificates" 2>&1 || true
     fi
@@ -122,7 +128,7 @@ if [ "$GREENFIELD" = true ]; then
     fi
 
     # Copy certificates from backup vault to Zoraxy cert dir
-    for DOMAIN_SUB in app dns www; do
+    for DOMAIN_SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
         FQDN="${DOMAIN_SUB}.${DOMAIN}"
         CERT_SRC="$BACKUP_DIR/certificates/${FQDN}/fullchain.pem"
         KEY_SRC="$BACKUP_DIR/certificates/${FQDN}/privkey.pem"
@@ -178,7 +184,7 @@ EOF
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/app.$DOMAIN.config" <<ZORAXY_APP
 {
     "ProxyType": 1,
-    "RootOrMatchingDomain": "app.$DOMAIN",
+    "RootOrMatchingDomain": "${APP_SUB}.$DOMAIN",
     "ActiveOrigins": [{
         "OriginIpOrDomain": "127.0.0.1:9000",
         "RequireTLS": false,
@@ -190,10 +196,10 @@ EOF
 }
 ZORAXY_APP
 
-    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/dns.$DOMAIN.config" <<ZORAXY_DNS
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/$DNS_SUB.$DOMAIN.config" <<ZORAXY_DNS
 {
     "ProxyType": 1,
-    "RootOrMatchingDomain": "dns.$DOMAIN",
+    "RootOrMatchingDomain": "${DNS_SUB}.$DOMAIN",
     "ActiveOrigins": [{
         "OriginIpOrDomain": "127.0.0.1:8000",
         "RequireTLS": false,
@@ -205,10 +211,10 @@ ZORAXY_APP
 }
 ZORAXY_DNS
 
-    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/www.$DOMAIN.config" <<ZORAXY_WWW
+    cat > "$TARGET_DIR/config/zoraxy/conf/proxy/$WWW_SUB.$DOMAIN.config" <<ZORAXY_WWW
 {
     "ProxyType": 1,
-    "RootOrMatchingDomain": "www.$DOMAIN",
+    "RootOrMatchingDomain": "${WWW_SUB}.$DOMAIN",
     "ActiveOrigins": [{
         "OriginIpOrDomain": "127.0.0.1:9000",
         "RequireTLS": false,
@@ -223,7 +229,7 @@ ZORAXY_WWW
     cat > "$TARGET_DIR/config/zoraxy/conf/proxy/auth.$DOMAIN.config" <<ZORAXY_AUTH
 {
     "ProxyType": 1,
-    "RootOrMatchingDomain": "auth.$DOMAIN",
+    "RootOrMatchingDomain": "${AUTH_SUB}.$DOMAIN",
     "ActiveOrigins": [{
         "OriginIpOrDomain": "127.0.0.1:5489",
         "RequireTLS": false,
@@ -292,7 +298,8 @@ EOF
     # Upload certs to Zoraxy via API (needed to register them in sys.db)
     echo "[*] Registering certificates in Zoraxy..."
     CERTS_DIR="$TARGET_DIR/config/zoraxy/conf/certs"
-    for FQDN in app.${DOMAIN} dns.${DOMAIN} www.${DOMAIN}; do
+    for SUB in $APP_SUB $DNS_SUB $WWW_SUB; do
+        FQDN="${SUB}.${DOMAIN}"
         CRT_FILE="$CERTS_DIR/${FQDN}.crt"
         [ -f "$CRT_FILE" ] || continue
         for TRY in 1 2 3 4 5; do