diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 628b389..718184a 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -118,7 +118,11 @@ loki.franksdank.cloud {
 # ═══════════════════════════════════════════════════════════════
 
 # --- Plex (existing, kept) ---
-plex.franksdank.casa {
+# http:// on purpose: franksdank.casa is not hosted in the same Porkbun
+# account as franksdank.cloud, so the DNS-01 provider cannot issue a
+# Let's Encrypt cert for it. It stays plain-HTTP legacy; the canonical
+# name is plex.franksdank.cloud (HTTPS, below).
+http://plex.franksdank.casa {
 	reverse_proxy 192.168.0.235:32400
 }
 
diff --git a/tests/caddyfile.bats b/tests/caddyfile.bats
index 2afb4fe..72443bb 100644
--- a/tests/caddyfile.bats
+++ b/tests/caddyfile.bats
@@ -61,8 +61,13 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 
 # --- Phase 2: real TLS via DNS-01 (Porkbun wildcard cert) ---
 
-@test "all vhosts use TLS (no http:// site prefix remains)" {
-    ! grep -qE '^http://' "$CADDYFILE"
+@test "all vhosts use TLS except the legacy .casa name" {
+    # franksdank.casa is not in the same Porkbun account, so it cannot get
+    # a DNS-01 Let's Encrypt cert; it stays explicitly http. Every other
+    # site address must carry no http:// prefix.
+    local offenders
+    offenders=$(grep -E '^http://' "$CADDYFILE" | grep -v 'plex\.franksdank\.casa' || true)
+    [ -z "$offenders" ] || { echo "non-.casa http:// vhosts: $offenders"; return 1; }
 }
 
 @test "the Caddyfile configures the Porkbun DNS-01 provider globally" {