diff --git a/code/deploy-release.sh b/code/deploy-release.sh
index bced6fd35c1e..14879a55a6f2 100644
--- a/code/deploy-release.sh
+++ b/code/deploy-release.sh
@@ -6,6 +6,7 @@ exec 9>/root/pldb-deploy.lock
 flock -w 600 9
 
 INSTALL_DIR=/root/pldb
+HEALTH_URL=${PLDB_HEALTH_URL:-http://127.0.0.1:3000/}
 STAGING=$(mktemp -d /root/pldb-staging.XXXXXX)
 BACKUP="$STAGING/previous"
 SWAPPED=false
@@ -52,7 +53,7 @@ systemctl restart pldb
 
 for attempt in {1..12}; do
     if systemctl is-active --quiet pldb && \
-        curl --fail --silent --max-time 5 http://localhost:80/ -o /dev/null; then
+        curl --fail --silent --max-time 5 "$HEALTH_URL" -o /dev/null; then
         SUCCESS=true
         echo 'PLDB deployment healthy.'
         exit 0
diff --git a/code/test_deploy_release.py b/code/test_deploy_release.py
index d3f31b792e8a..877a9dcc193c 100644
--- a/code/test_deploy_release.py
+++ b/code/test_deploy_release.py
@@ -53,6 +53,11 @@ def deploy(self, scenario="success", download=False):
     for last; do :; done
     cp "$ARTIFACT" "$last"
 else
+    # Reject a health check routed through Nginx's HTTP redirect.
+    case " $* " in
+        *" http://127.0.0.1:3000/ "*) ;;
+        *) exit 1 ;;
+    esac
     [ "$SCENARIO" != health ]
 fi''',
             }
diff --git a/readme.md b/readme.md
index e1b2f78230eb..b284e6a7f0dd 100644
--- a/readme.md
+++ b/readme.md
@@ -231,6 +231,25 @@ Both update paths stage dependencies before replacing the site, serialize with
 
 For a manual deployment on the server, run `bash /root/pldb-update.sh`.
 
+### Production HTTPS
+
+Production uses Nginx on ports 80/443, forwarding to PLDB on
+`127.0.0.1:3000`. The systemd override at
+`/etc/systemd/system/pldb.service.d/https.conf` sets
+`ExecStart=/usr/bin/npx serve . -l tcp://127.0.0.1:3000` (after clearing ExecStart).
+Certbot manages the certificate for `pldb.info` and `www.pldb.info` and renews
+it through `snap.certbot.renew.timer`.
+
+Deployments check the application directly on port 3000, so an Nginx redirect
+cannot mask application failure. For a legacy HTTP-only server, set
+`PLDB_HEALTH_URL=http://127.0.0.1:80/`; fresh bootstrap installations set this
+in the weekly wrapper until the HTTPS override exists.
+
+Site artifact updates preserve Nginx configuration, certificates, and the
+systemd override outside `/root/pldb`. Do not rerun `setup-pldb.sh` on the
+HTTPS server: it provisions an HTTP-only server and now refuses to run when
+the HTTPS override exists. Use the release deployment workflow instead.
+
 ## 🌐 Mirrors
 
 The primary site is hosted at [pldb.info](http://pldb.info) via ScrollHub. For offline access or redundancy, you can clone the repository and build locally:
diff --git a/settings.scroll b/settings.scroll
index 2cccc343a013..cbe5be9ffcf5 100644
--- a/settings.scroll
+++ b/settings.scroll
@@ -1,3 +1,3 @@
-baseUrl http://pldb.info/
+baseUrl https://pldb.info/
 description PLDB: a Programming Language Database. Build the next great programming language.
 email pldb-admins@googlegroups.com
diff --git a/setup-pldb.sh b/setup-pldb.sh
index 5fc3b248a1c0..0ff43926f2d3 100644
--- a/setup-pldb.sh
+++ b/setup-pldb.sh
@@ -36,6 +36,11 @@ set -e
 REPO_URL="$1"
 export DEBIAN_FRONTEND=noninteractive
 
+if [ -f /etc/systemd/system/pldb.service.d/https.conf ]; then
+    echo 'HTTPS is configured. Use /root/pldb-update.sh for deployments; this bootstrap script requires port 80.' >&2
+    exit 1
+fi
+
 echo ">>> Updating package lists..."
 apt-get update -qq
 
@@ -216,6 +221,10 @@ cat > /root/pldb-update.sh << 'UPDATEEOF'
 #!/bin/bash
 # Use the deployed updater so improvements arrive with each release.
 set -euo pipefail
+# Fresh HTTP-only installations use port 80 until HTTPS is configured.
+if [ ! -f /etc/systemd/system/pldb.service.d/https.conf ]; then
+    export PLDB_HEALTH_URL=http://127.0.0.1:80/
+fi
 exec bash /root/pldb/code/deploy-release.sh
 UPDATEEOF
 chmod +x /root/pldb-update.sh