diff --git a/apps/demo/ingress.yaml b/apps/demo/ingress.yaml
index 4268514..5f0b4dc 100644
--- a/apps/demo/ingress.yaml
+++ b/apps/demo/ingress.yaml
@@ -10,16 +10,17 @@
 # cert-manager.io/cluster-issuer triggers cert-manager's "ingress-shim": it
 # notices this annotation, creates a Certificate resource for the
 # hostname(s) in tls.hosts below, and keeps it renewed automatically
-# forever. Deliberately pointed at letsencrypt-staging first — see
-# docs/12-cert-manager.md for why, and switch to letsencrypt-prod only
-# after confirming staging actually works for this hostname.
+# forever. This was proven against letsencrypt-staging first — see
+# docs/12-cert-manager.md — before switching to the real, browser-trusted
+# letsencrypt-prod here. Always prove a new hostname against staging
+# first; production has much stricter rate limits.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: demo
   namespace: demo
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-staging
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
   tls:
     - hosts: