diff --git a/homelab-services/minio-service/flake.nix b/homelab-services/minio-service/flake.nix
index dd68826..b6de407 100755
--- a/homelab-services/minio-service/flake.nix
+++ b/homelab-services/minio-service/flake.nix
@@ -183,8 +183,8 @@ EOF
             enable = true;
             virtualHosts.${opts.default-nginx.hostname} = {
               forceSSL = true;
-              enableACME = true;
-              acmeRoot = null;
+              # Parse TLD from hostname to use wildcard cert
+              useACMEHost = (domain: let parts = lib.strings.split "." domain; len = builtins.length parts; in if len>=2 then lib.strings.concatStringsSep "." (lib.lists.drop (len - 2) parts) else domain) "${opts.default-nginx.hostname}";
 
               # This does not work even with the MINIO_BROWSER_REDIRECT_URL set
               locations."/console" = {
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index cd37045..9d4a07a 100755
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -51,7 +51,7 @@
   security.acme = {
     acceptTerms = true;
     defaults = {
-      # use staging testing
+      # use staging for testing
       server = "https://acme-staging-v02.api.letsencrypt.org/directory";
       # use prod for deploy
       # server = "https://acme-v02.api.letsencrypt.org/directory";