diff --git a/servers/kuribo/configuration.nix b/servers/kuribo/configuration.nix
index f392143..29b2870 100644
--- a/servers/kuribo/configuration.nix
+++ b/servers/kuribo/configuration.nix
@@ -5,8 +5,7 @@
     ../../modules/gc.nix
     ../../users/users.nix
     ./caddy.nix
-    ./pds.nix           # Old PDS on port 3000 - remove after migration
-    ./tranquil-pds.nix  # Tranquil on port 3001 at new.pds.starhaven.dev
+    ./tranquil-pds.nix
     ./tangled.nix
     ./papermario-dx-build.nix
   ];
diff --git a/servers/kuribo/tranquil-pds.nix b/servers/kuribo/tranquil-pds.nix
index 33dae05..7cadfab 100644
--- a/servers/kuribo/tranquil-pds.nix
+++ b/servers/kuribo/tranquil-pds.nix
@@ -1,7 +1,7 @@
-# STAGING CONFIG: Tranquil at new.pds.starhaven.dev (port 3001)
-# Old PDS stays at pds.starhaven.dev (port 3000)
-# After migration, change hostname back to pds.starhaven.dev and port to 3000
 { config, pkgs, ... }:
+let
+  pdsSettings = config.services.tranquil-pds.settings;
+in
 {
   sops.secrets.tranquil-pds = {
     sopsFile = ../../secrets/kuribo/tranquil-pds.env;
@@ -17,9 +17,8 @@
 
     settings = {
       server = {
-        # STAGING: temporary subdomain during migration
-        hostname = "new.pds.starhaven.dev";
-        port = 3001;
+        hostname = "pds.starhaven.dev";
+        port = 3000;
         user_handle_domains = [ ".starhaven.dev" ];
         contact_email = "admin@starhaven.dev";
 
@@ -42,24 +41,24 @@
         enabled = true;
         display_name = "Discord";
       };
-
-      # Accept repo imports for migration
-      import = {
-        accepting = true;
-        max_size = 1073741824; # 1GB
-      };
     };
   };
 
-  # Caddy: serve both old PDS and new Tranquil
-  services.caddy.virtualHosts."new.pds.starhaven.dev" = {
-    extraConfig = ''
-      tls {
-        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-      }
-      reverse_proxy http://127.0.0.1:3001
-    '';
-  };
+  # Caddy config
+  starhaven.caddy.adminEmail = pdsSettings.server.contact_email;
+  starhaven.caddy.extraHandles = ''
+    handle /xrpc/app.bsky.unspecced.getAgeAssuranceState {
+      header content-type "application/json"
+      header access-control-allow-headers "authorization,dpop,atproto-accept-labelers,atproto-proxy"
+      header access-control-allow-origin "*"
+      respond `{"lastInitiatedAt":"2025-07-14T14:22:43.912Z","status":"assured"}` 200
+    }
+  '';
+  starhaven.caddy.fallbackHandle = ''
+    handle {
+      reverse_proxy http://127.0.0.1:${toString pdsSettings.server.port}
+    }
+  '';
 
   # Caddy needs the secrets for CLOUDFLARE_API_TOKEN
   systemd.services.caddy = {
@@ -70,4 +69,8 @@
     ];
     serviceConfig.EnvironmentFile = config.sops.secrets.tranquil-pds.path;
   };
+
+  # On-demand TLS helper proxies unknown domain checks to PDS
+  systemd.services.ondemand-tls-helper.serviceConfig.Environment =
+    "PDS_PORT=${toString pdsSettings.server.port}";
 }