diff --git a/ansible/group_vars/all/main.yml b/ansible/group_vars/all/main.yml
index 9cf3143..0ff8ef8 100644
--- a/ansible/group_vars/all/main.yml
+++ b/ansible/group_vars/all/main.yml
@@ -58,3 +58,17 @@ subdomains:
 # group covers them, so these are global rather than group_vars/<group>.
 ntfy_topic: alerts
 headscale_namespace: counter-net
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Domains whose registration expiry is monitored (infra/402_public_monitoring).
+#
+# Registration renewal is a manual act at the registrar, and losing a domain is
+# not recoverable in the way losing a host is - so these are checked daily and
+# alarm with two weeks of runway.
+#
+# root_domain is the estate's own domain; the rest are domains we own that are
+# served from it or from a host in the inventory.
+# ─────────────────────────────────────────────────────────────────────────────
+monitored_domains:
+  - "{{ root_domain }}"
+  - arbret.com
diff --git a/ansible/infra/402_public_monitoring.yml b/ansible/infra/402_public_monitoring.yml
index b2c329b..7ff7cf8 100644
--- a/ansible/infra/402_public_monitoring.yml
+++ b/ansible/infra/402_public_monitoring.yml
@@ -61,25 +61,24 @@
 
   tasks:
     # ── Domain expiry ────────────────────────────────────────────────────────
-    - name: Build the domain endpoint
+    # Each domain needs a URL SCHEME: Gatus derives the endpoint type from the
+    # prefix (endpoint.Type()), so a bare "example.com" is UNKNOWN and the whole
+    # config is rejected. No status is asserted, only the WHOIS/RDAP expiry, so
+    # whatever the apex serves - a real site, or the registrar's parking page -
+    # is irrelevant.
+    #
+    # 24h, and upstream enforces a 5m minimum for DOMAIN_EXPIRATION anyway
+    # because it uses a free whois service that must not be hammered.
+    # 336h = 14 days of runway, because renewal is a manual act at the registrar.
+    - name: Build the domain endpoints
       ansible.builtin.set_fact:
-        domain_endpoints:
-          - name: "{{ root_domain }}"
-            group: domain
-            # Needs a scheme: Gatus derives the endpoint TYPE from the URL prefix
-            # (endpoint.Type()), and a bare domain is UNKNOWN and rejected. The
-            # apex points at the registrar's parking page, which is irrelevant -
-            # the only condition here is the WHOIS expiry, and no status check is
-            # asserted, so what the page serves does not matter.
-            url: "https://{{ root_domain }}"
-            # 24h, and upstream enforces a 5m minimum for DOMAIN_EXPIRATION
-            # anyway because it uses a free whois service that must not be
-            # hammered and whose data updates slowly.
-            interval: 24h
-            # 336h = 14 days. Renewal is manual at the registrar, so this needs
-            # enough runway to act on.
-            conditions:
-              - "[DOMAIN_EXPIRATION] > 336h"
+        domain_endpoints: "{{ domain_endpoints | default([]) + [{
+          'name': item,
+          'group': 'domain',
+          'url': 'https://' ~ item,
+          'interval': '24h',
+          'conditions': ['[DOMAIN_EXPIRATION] > 336h']}] }}"
+      loop: "{{ monitored_domains }}"
 
     # ── DNS ──────────────────────────────────────────────────────────────────
     - name: Build the DNS endpoints