diff --git a/serving/fleet-manager/.env.example b/serving/fleet-manager/.env.example
index 365b8ed..c8b1c55 100644
--- a/serving/fleet-manager/.env.example
+++ b/serving/fleet-manager/.env.example
@@ -28,6 +28,9 @@ ACME_EMAIL=you@bitasylum.org
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_REGION=us-east-1
+# Optional but recommended: pin the Route 53 zone. Skips ListHostedZonesByName
+# (so you can drop it from the IAM policy) and disambiguates public/private zones.
+AWS_HOSTED_ZONE_ID=
 # ACME_STAGING=1   # uncomment for a dry-run vs LE staging (UNTRUSTED certs, no rate limit)
 
 # --- agent plane (gRPC + mTLS, fleet CA) ---------------------------------------
diff --git a/serving/fleet-manager/DEPLOY.md b/serving/fleet-manager/DEPLOY.md
index b8c7365..a670a88 100644
--- a/serving/fleet-manager/DEPLOY.md
+++ b/serving/fleet-manager/DEPLOY.md
@@ -120,6 +120,12 @@ instance role and omit them):
 }
 ```
 
+`AWS_HOSTED_ZONE_ID` is **optional**: lego auto-discovers the zone via
+`ListHostedZonesByName` (hence that statement). Set it in `.env` to pin the zone
+— required if a **public + private** zone share `bitasylum.org` (auto-discovery
+may pick the wrong one), and it lets you **drop the `ListHostedZonesByName`
+statement** for a tighter policy.
+
 **Run it** (bring the side-car up first so the cert exists before the manager):
 
 ```bash
diff --git a/serving/fleet-manager/docker-compose.yml b/serving/fleet-manager/docker-compose.yml
index 527edd4..a01f3e9 100644
--- a/serving/fleet-manager/docker-compose.yml
+++ b/serving/fleet-manager/docker-compose.yml
@@ -129,6 +129,9 @@ services:
       AWS_ACCESS_KEY_ID: "${AWS_ACCESS_KEY_ID:-}"
       AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY:-}"
       AWS_REGION: "${AWS_REGION:-us-east-1}"
+      # Optional: pin the zone (skips the ListHostedZonesByName lookup — needed if
+      # a public + private zone share the domain; lets you tighten the IAM policy).
+      AWS_HOSTED_ZONE_ID: "${AWS_HOSTED_ZONE_ID:-}"
     volumes:
       - ./acme/renew-loop.sh:/renew-loop.sh:ro
       - acme-state:/le               # lego account + cert store — PERSIST