diff --git a/docker/unified/docker-compose.yaml b/docker/unified/docker-compose.yaml
index 0bc1ecaa6..199d0da21 100755
--- a/docker/unified/docker-compose.yaml
+++ b/docker/unified/docker-compose.yaml
@@ -1,3 +1,6 @@
+# sudo certbot certonly --standalone --http-01-port 8080
+# cerbot needs to run on 8080 since port 80 is used by the gateway
+
 services:
   # Gateway (Single Entry Point)
   gateway:
diff --git a/docker/unified/gateway/nginx.conf b/docker/unified/gateway/nginx.conf
index d0989ace1..47ad4695e 100644
--- a/docker/unified/gateway/nginx.conf
+++ b/docker/unified/gateway/nginx.conf
@@ -3,16 +3,23 @@ proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 
-# --- PRODUCTION: demo.checkmate.so ---
+
 server {
     listen 80;
-    server_name demo.checkmate.so;
-    
+    server_name demo.checkmate.so staging.checkmate.so;
+
+    location /.well-known/acme-challenge/ {
+        # Forward the challenge to Certbot listening on 8080
+        proxy_pass http://172.17.0.1:8080;
+    }
+
     location / {
         return 301 https://$host$request_uri;
     }
 }
 
+
+# --- PRODUCTION: demo.checkmate.so ---
 server {
     listen 443 ssl;
     server_name demo.checkmate.so;
@@ -30,27 +37,19 @@ server {
 }
 
 # --- STAGING: staging.checkmate.so ---
-# server {
-#     listen 80;
-#     server_name staging.checkmate.so;
-    
-#     location / {
-#         return 301 https://$host$request_uri;
-#     }
-# }
 
-# server {
-#     listen 443 ssl;
-#     server_name staging.checkmate.so;
+ server {
+     listen 443 ssl;
+     server_name staging.checkmate.so;
 
-#     ssl_certificate     /etc/nginx/ssl/live/staging.checkmate.so/fullchain.pem;
-#     ssl_certificate_key /etc/nginx/ssl/live/staging.checkmate.so/privkey.pem;
+     ssl_certificate     /etc/nginx/ssl/live/staging.checkmate.so/fullchain.pem;
+     ssl_certificate_key /etc/nginx/ssl/live/staging.checkmate.so/privkey.pem;
 
-#     ssl_protocols       TLSv1.2 TLSv1.3;
-#     ssl_ciphers         HIGH:!aNULL:!MD5;
+     ssl_protocols       TLSv1.2 TLSv1.3;
+     ssl_ciphers         HIGH:!aNULL:!MD5;
 
-#     location / {
-#         # Passes traffic to the staging client on port 80
-#         proxy_pass http://client-stage:80;
-#     }
-# }
\ No newline at end of file
+     location / {
+         # Passes traffic to the staging client on port 80
+         proxy_pass http://client-staging:80;
+     }
+ }