diff --git a/traefik.yml b/traefik.yml
index 65437e1..e5cef07 100644
--- a/traefik.yml
+++ b/traefik.yml
@@ -59,10 +59,19 @@ certificatesResolvers:
     acme:
       email: pkartch@gmail.com
       storage: acme.json
-      # HTTP-01: public port 80 forwards to this host, so the challenge
-      # reaches us directly. The dev host cannot use this — see traefik.dev.yml.
-      httpChallenge:
-        entryPoint: http
+      # DNS-01 via Route 53 (since 2026-11-03; was HTTP-01). Proves control with
+      # an _acme-challenge TXT record, so certificates no longer depend on public
+      # port 80 reaching this host, and a name can be certified before its A
+      # record points here (e.g. a site migration). Credentials: IAM user
+      # traefik-prod-dns01 in .env, allowed ONLY to write _acme-challenge.* TXT
+      # records in the pkartchner.com and backyardhoneycomb.com zones.
+      dnsChallenge:
+        provider: route53
+        # Check propagation against public resolvers: Pi-hole answers for
+        # internal names and never sees the TXT record.
+        resolvers:
+          - "1.1.1.1:53"
+          - "8.8.8.8:53"
 
 log:
   level: INFO