diff --git a/infra/aws/README.md b/infra/aws/README.md
index 8efb79d..7c746a5 100644
--- a/infra/aws/README.md
+++ b/infra/aws/README.md
@@ -75,8 +75,9 @@ http://<ElasticIp>/login
 After the HTTP replica is healthy:
 
 1. Change the Namecheap root `A` record (`@`) to the stack's `ElasticIp` output.
-2. Wait until `encodexdrive.com` resolves to the new address.
-3. Through SSM, switch Caddy to its production configuration:
+2. Change the Namecheap `www` `A` record to the same `ElasticIp` output.
+3. Wait until both domains resolve to the new address.
+4. Through SSM, switch Caddy to its production configuration:
 
 ```bash
 sudo ln -sfn /etc/caddy/Caddyfile.production /etc/caddy/Caddyfile
@@ -84,9 +85,9 @@ sudo caddy validate --config /etc/caddy/Caddyfile
 sudo systemctl reload caddy
 ```
 
-4. Verify `https://encodexdrive.com/login` and an authenticated database-backed
+5. Verify both HTTPS hostnames and an authenticated database-backed
    API request.
-5. Keep the old EC2 instance running for a rollback window.
+6. Keep the old EC2 instance running for a rollback window.
 
 The old AWS credentials and SSH GitHub secrets should only be removed after the
 new deployment and DNS cutover have been stable.
diff --git a/infra/aws/encodex-replica.yml b/infra/aws/encodex-replica.yml
index 5fefe49..c3fba47 100644
--- a/infra/aws/encodex-replica.yml
+++ b/infra/aws/encodex-replica.yml
@@ -254,6 +254,11 @@ Resources:
             encode zstd gzip
             reverse_proxy 127.0.0.1:30180
           }
+
+          www.${DomainName} {
+            encode zstd gzip
+            reverse_proxy 127.0.0.1:30180
+          }
           CADDY_PRODUCTION
 
           chown root:caddy /etc/caddy/Caddyfile.pre-dns /etc/caddy/Caddyfile.production