diff --git a/docker-compose.arena.yml b/docker-compose.arena.yml
index 1c4a947..200cac8 100644
--- a/docker-compose.arena.yml
+++ b/docker-compose.arena.yml
@@ -38,7 +38,8 @@ services:
       - NODE_ENV=production
       - PORT=9100
       - FIGHT_LOOP_ENABLED=true
-      - PUBLIC_ARENA_URL=http://146.59.87.168:9100
+      - PUBLIC_ARENA_URL=https://botfights.archipelago-foundation.org
+      - TRUSTED_PROXY=1
       # Auth — value comes from the host .env, never hardcoded here.
       # Generated on VPS2 with: openssl rand -hex 32 (see docs/arena-deployment.md)
       - JWT_SECRET=${JWT_SECRET}
diff --git a/docs/arena-deployment.md b/docs/arena-deployment.md
index 4af889d..6752a43 100644
--- a/docs/arena-deployment.md
+++ b/docs/arena-deployment.md
@@ -44,7 +44,7 @@ hardcoded to one server:
 | Image | `localhost:3000/lfg2025/botfights:1.1.0` (Gitea registry on the same host; `localhost:3000` resolves without any insecure-registry config because Docker trusts loopback registries by default — this is why the compose file uses `localhost:3000`, not the public `146.59.87.168:3000`, as the image ref) |
 | Port | **9100** (verified free before binding; now bound — see `ss -tlnp` output in this phase's execution log) |
 | Data volume | named volume `botfights-arena-data` → `/app/server/data` inside the container (host mountpoint: `docker volume inspect botfights-arena_botfights-arena-data --format '{{.Mountpoint}}'`) |
-| **Canonical URL** | **`http://146.59.87.168:9100`** — plain HTTP, no DNS, no TLS (user decision 2026-07-30, see below) |
+| **Canonical URL** | **`https://botfights.archipelago-foundation.org`** — TLS via nginx-proxy-manager + Let's Encrypt (user created DNS + proxy host 2026-07-30). Raw fallback: `http://146.59.87.168:9100` |
 
 ### Why plain HTTP on the raw port (no DNS/TLS this phase)
 
@@ -87,7 +87,7 @@ When DNS/TLS is wanted:
      (`ssl_forced=1`) — mirrors the existing `demo.`/`source.`/`fips.` hosts.
 3. Change **only** the value every node reads: `ARENA_UPSTREAM_URL` in
    `apps/botfights/manifest.yml` (archy repo) from
-   `http://146.59.87.168:9100` to `https://arena.archipelago-foundation.org`.
+   `http://146.59.87.168:9100` to `https://botfights.archipelago-foundation.org` — DONE 2026-07-30: the user created the DNS A record and the NPM proxy host with a Let's Encrypt cert; `TRUSTED_PROXY=1` was enabled on the arena at the same time (it now sits behind NPM).
    No code change — the reverse-proxy middleware and NIP-98 verification are
    both already origin-independent (path-only URL comparison).
 4. Optionally keep `:9100` open as a fallback/legacy path, or firewall it