diff --git a/roles/traefik/defaults/main.yml b/roles/traefik/defaults/main.yml
index 2eb03a1..fff0b66 100644
--- a/roles/traefik/defaults/main.yml
+++ b/roles/traefik/defaults/main.yml
@@ -5,6 +5,7 @@ traefik_websecure_port: 443
 traefik_dashboard_port: 8080
 traefik_metrics_port: 8100
 traefik_dashboard_insecure: true   # ufw should only allow from tailscale or vnet
+traefik_acme_staging: "{{ lookup('env', 'TRAEFIK_ACME_STAGING') | default('false', true) }}"
 
 domain: "{{ lookup('env', 'DOMAIN') | default('', true) }}"
 # Single source of truth for static routing. Expected to be overridden
diff --git a/roles/traefik/templates/dynamic-analytics.yml.j2 b/roles/traefik/templates/dynamic-analytics.yml.j2
index df83184..42ce8fc 100644
--- a/roles/traefik/templates/dynamic-analytics.yml.j2
+++ b/roles/traefik/templates/dynamic-analytics.yml.j2
@@ -9,6 +9,10 @@ http:
       service: analytics-svc
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "analytics.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     analytics-svc:
diff --git a/roles/traefik/templates/dynamic-hosts.yml.j2 b/roles/traefik/templates/dynamic-hosts.yml.j2
index 4cb6735..5844d6f 100644
--- a/roles/traefik/templates/dynamic-hosts.yml.j2
+++ b/roles/traefik/templates/dynamic-hosts.yml.j2
@@ -9,6 +9,10 @@ http:
         - websecure
       tls:
         certResolver: letsencrypt
+        domains:
+          - main: "app.{{ env_vars.DOMAIN }}"
+            sans:
+              - "blog.{{ env_vars.DOMAIN }}"
 
   services:
     retailor-web-svc:
diff --git a/roles/traefik/templates/traefik.yml.j2 b/roles/traefik/templates/traefik.yml.j2
index e0d1ebf..c2556ec 100644
--- a/roles/traefik/templates/traefik.yml.j2
+++ b/roles/traefik/templates/traefik.yml.j2
@@ -27,6 +27,9 @@ certificatesResolvers:
     acme:
       email: "{{ traefik_acme_email }}"
       storage: /etc/traefik/acme.json
+{% if traefik_acme_staging | bool %}
+      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+{% endif %}
       httpChallenge:
         entryPoint: web