diff --git a/.env.docker.production.example b/.env.docker.production.example
index 4c73881..f684cab 100644
--- a/.env.docker.production.example
+++ b/.env.docker.production.example
@@ -1,6 +1,6 @@
 # ── Traefik domains — used in docker-compose labels ──────────────────────────
 ACME_EMAIL=rentaldrivego@gmail.com
-MARKETPLACE_DOMAIN=rentaldrivego.ma
+MARKETPLACE_DOMAIN=app.rentaldrivego.ma
 API_DOMAIN=api.rentaldrivego.ma
 DASHBOARD_DOMAIN=dashboard.rentaldrivego.ma
 ADMIN_DOMAIN=admin.rentaldrivego.ma
@@ -21,7 +21,7 @@ NEXT_PUBLIC_API_URL=https://api.rentaldrivego.ma/api/v1
 
 # ── Frontend public URLs ───────────────────────────────────────────────────────
 NEXT_PUBLIC_MARKETING_URL=https://rentaldrivego.ma
-NEXT_PUBLIC_MARKETPLACE_URL=https://rentaldrivego.ma/explore
+NEXT_PUBLIC_MARKETPLACE_URL=https://app.rentaldrivego.ma/explore
 NEXT_PUBLIC_DASHBOARD_URL=https://dashboard.rentaldrivego.ma
 NEXT_PUBLIC_ADMIN_URL=https://admin.rentaldrivego.ma
 NEXT_PUBLIC_PUBLIC_SITE_DOMAIN=rentaldrivego.ma
@@ -29,7 +29,7 @@ DASHBOARD_URL=https://dashboard.rentaldrivego.ma
 
 # ── CORS ──────────────────────────────────────────────────────────────────────
 # Comma-separated list of allowed browser origins. REQUIRED in production.
-CORS_ORIGINS=https://rentaldrivego.ma,https://dashboard.rentaldrivego.ma,https://admin.rentaldrivego.ma
+CORS_ORIGINS=https://rentaldrivego.ma,https://app.rentaldrivego.ma,https://dashboard.rentaldrivego.ma,https://admin.rentaldrivego.ma
 
 # ── Auth ──────────────────────────────────────────────────────────────────────
 JWT_SECRET=PMPS5k0D7rUeJOk0NkhI5bRtoGjkUqjK
diff --git a/DOCKER.md b/DOCKER.md
index 3aa06ac..09a681e 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -112,7 +112,8 @@ Add an A record for every subdomain to your server's public IP before deploying
 
 | Subdomain | Service |
 |---|---|
-| `rentaldrivego.ma` | marketplace + public site |
+| `rentaldrivego.ma` | public site |
+| `app.rentaldrivego.ma` | marketplace |
 | `api.rentaldrivego.ma` | API |
 | `dashboard.rentaldrivego.ma` | dashboard |
 | `admin.rentaldrivego.ma` | admin panel |
@@ -151,7 +152,7 @@ Open `.env.docker.production` and fill in every value. The minimum required secr
 | `ACME_EMAIL` | Your email for Let's Encrypt notifications |
 | `RESEND_API_KEY` | Resend API key (or configure SMTP vars instead) |
 
-All domain vars are pre-filled with `rentaldrivego.ma` subdomains and do not need changing unless you use a different domain.
+The example file uses `rentaldrivego.ma` for the public site and `app.rentaldrivego.ma` for the marketplace. Adjust them only if you use different hostnames.
 
 #### 5. Start Traefik
 
diff --git a/apps/public-site/src/middleware.ts b/apps/public-site/src/middleware.ts
index b2f67ac..ff2e573 100644
--- a/apps/public-site/src/middleware.ts
+++ b/apps/public-site/src/middleware.ts
@@ -1,13 +1,13 @@
 import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 
-const PRODUCTION_DOMAIN = 'rentaldrivego.com'
+const PRODUCTION_DOMAIN = process.env.NEXT_PUBLIC_PUBLIC_SITE_DOMAIN ?? 'rentaldrivego.ma'
 const DEFAULT_SLUG = process.env.NEXT_PUBLIC_COMPANY_SLUG ?? 'demo'
 
 /**
  * Resolve the company slug from the request host.
  *
- * Production:  {slug}.rentaldrivego.com  →  slug
+ * Production:  {slug}.<public-site-domain>  →  slug
  * Development: localhost / 127.0.0.1     →  DEFAULT_SLUG (env var fallback)
  * Staging/preview URLs that don't match the production domain also fall back.
  */
@@ -17,7 +17,7 @@ function resolveSlug(host: string | null): string {
   // Strip port number if present
   const hostname = host.split(':')[0]
 
-  // Production subdomain: slug.rentaldrivego.com
+  // Production subdomain: slug.<public-site-domain>
   if (hostname.endsWith(`.${PRODUCTION_DOMAIN}`)) {
     const subdomain = hostname.slice(0, hostname.length - PRODUCTION_DOMAIN.length - 1)
     // Ignore www / bare domain
diff --git a/docker-compose.production.yml b/docker-compose.production.yml
index f3a2eb7..c502a71 100644
--- a/docker-compose.production.yml
+++ b/docker-compose.production.yml
@@ -84,8 +84,14 @@ services:
     restart: unless-stopped
     labels:
       - traefik.enable=true
-      # marketplace (port 3000) — owns both bare and www domains
-      - traefik.http.routers.marketplace.rule=Host(`rentaldrivego.ma`) || Host(`www.rentaldrivego.ma`)
+      # public site (port 3003) — owns both bare and www domains
+      - traefik.http.routers.public-site.rule=Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)
+      - traefik.http.routers.public-site.entrypoints=websecure
+      - traefik.http.routers.public-site.tls.certresolver=letsencrypt
+      - traefik.http.routers.public-site.service=public-site-svc
+      - traefik.http.services.public-site-svc.loadbalancer.server.port=3003
+      # marketplace (port 3000) — should use its own subdomain
+      - traefik.http.routers.marketplace.rule=Host(`${MARKETPLACE_DOMAIN}`)
       - traefik.http.routers.marketplace.entrypoints=websecure
       - traefik.http.routers.marketplace.tls.certresolver=letsencrypt
       - traefik.http.routers.marketplace.service=marketplace-svc