diff --git a/cloudflared-config.yml b/cloudflared-config.yml
index f52d74a3c..d2626b6b1 100644
--- a/cloudflared-config.yml
+++ b/cloudflared-config.yml
@@ -236,16 +236,17 @@ ingress:
 
   # ============================================
   # Zitare (Code/zitare, separate repo)
-  # ~/projects/zitare-deploy/ on the Mac Mini (planned — Phase 1.6).
+  # Stand 2026-05-20: zitare.com ist die kanonische Brand-Domain.
+  # zitare.mana.how ist abgeschaltet, zitare-api.mana.how bleibt als
+  # Back-Compat-Surface für externe Tooling.
   # Ports per mana/docs/PORTS.md: 3083 api / 3084 app / 3085 com.
-  # zitare.com is a separate Cloudflare zone; tunnel route for that
-  # hostname must be added via `cloudflared tunnel route dns
-  # 1435166a-0e3f-4222-8de6-744f32cea5c9 zitare.com` (one-time).
   # ============================================
   - hostname: zitare.com
     service: http://localhost:3085
-  - hostname: zitare.mana.how
+  - hostname: app.zitare.com
     service: http://localhost:3084
+  - hostname: api.zitare.com
+    service: http://localhost:3083
   - hostname: zitare-api.mana.how
     service: http://localhost:3083
 
diff --git a/docker-compose.macmini.yml b/docker-compose.macmini.yml
index 858dc0cfb..3af473bdf 100644
--- a/docker-compose.macmini.yml
+++ b/docker-compose.macmini.yml
@@ -248,7 +248,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.com,https://app.zitare.com,https://api.zitare.com,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
     ports:
       - "3001:3001"
     healthcheck: