diff --git a/.env b/.env
index 544f765..08af292 100644
--- a/.env
+++ b/.env
@@ -32,21 +32,21 @@ NATS_PASS="eiTh2chi-sahp3iJ9-PeeR4AiD-ahXa8EeG-eeLeew4i-fu4Aejei"
 # TLS_CA="/opt/containers/nats-registration-listener/data/8devices-root-ca.pem"
 
 # Option B: inline PEM (entrypoint writes to DATA_DIR/tls-ca.pem)
-# TLS_CA_PEM="-----BEGIN CERTIFICATE-----
-# MIICbDCCAdUCFCFi1ReBpGi0EQ+iZylOYXXF15elMA0GCSqGSIb3DQEBCwUAMHQx
-# CzAJBgNVBAYTAkxUMQowCAYDVQQIDAEtMRAwDgYDVQQHDAdWaWxuaXVzMRUwEwYD
-# VQQKDAw4REVWSUNFUyBVQUIxDDAKBgNVBAsMA1ImRDEiMCAGA1UEAwwZOERFVklD
-# RVMgUHJvZHVjdHMgUm9vdCBDQTAgFw0yMDA0MTYxMzIzMjBaGA8yMTIwMDMyMzEz
-# MjMyMFowdDELMAkGA1UEBhMCTFQxCjAIBgNVBAgMAS0xEDAOBgNVBAcMB1ZpbG5p
-# dXMxFTATBgNVBAoMDDhERVZJQ0VTIFVBQjEMMAoGA1UECwwDUiZEMSIwIAYDVQQD
-# DBk4REVWSUNFUyBQcm9kdWN0cyBSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
-# ADCBiQKBgQC0e3L19mgARZgb7yc331S03L85F/q0MHhXGeNA8XJCnzfSIny0EzgM
-# nrWKVvPSUdmb6lF/M7SCnbw3Suf1UD8AQYgjDNNh513zK5MhnZCwNfnXxv6upx78
-# PAMzLgKmEixErl8syRB1pfkz1Fc6GbOtdtAvzbFBD8FsHuNBYJxgqQIDAQABMA0G
-# CSqGSIb3DQEBCwUAA4GBADq6R9k9Ob6aqHda9ZZ+0BbPtQzC38QNJ8QCh4AFSIsK
-# RrJEcyns1Qnh7/5+ZOY/UhU4h++uBuUVacH4DmOJgbxae/OXNAMcpbvYM2SZ6KfR
-# 5eSeEAJ+t49b2SaanYhZFusrn1fi8JhJQ0wi5LYfmLz/Kf4zGGZj+IgR9QmwIcLf
-# -----END CERTIFICATE-----"
+TLS_CA_PEM="-----BEGIN CERTIFICATE-----
+MIICbDCCAdUCFCFi1ReBpGi0EQ+iZylOYXXF15elMA0GCSqGSIb3DQEBCwUAMHQx
+CzAJBgNVBAYTAkxUMQowCAYDVQQIDAEtMRAwDgYDVQQHDAdWaWxuaXVzMRUwEwYD
+VQQKDAw4REVWSUNFUyBVQUIxDDAKBgNVBAsMA1ImRDEiMCAGA1UEAwwZOERFVklD
+RVMgUHJvZHVjdHMgUm9vdCBDQTAgFw0yMDA0MTYxMzIzMjBaGA8yMTIwMDMyMzEz
+MjMyMFowdDELMAkGA1UEBhMCTFQxCjAIBgNVBAgMAS0xEDAOBgNVBAcMB1ZpbG5p
+dXMxFTATBgNVBAoMDDhERVZJQ0VTIFVBQjEMMAoGA1UECwwDUiZEMSIwIAYDVQQD
+DBk4REVWSUNFUyBQcm9kdWN0cyBSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
+ADCBiQKBgQC0e3L19mgARZgb7yc331S03L85F/q0MHhXGeNA8XJCnzfSIny0EzgM
+nrWKVvPSUdmb6lF/M7SCnbw3Suf1UD8AQYgjDNNh513zK5MhnZCwNfnXxv6upx78
+PAMzLgKmEixErl8syRB1pfkz1Fc6GbOtdtAvzbFBD8FsHuNBYJxgqQIDAQABMA0G
+CSqGSIb3DQEBCwUAA4GBADq6R9k9Ob6aqHda9ZZ+0BbPtQzC38QNJ8QCh4AFSIsK
+RrJEcyns1Qnh7/5+ZOY/UhU4h++uBuUVacH4DmOJgbxae/OXNAMcpbvYM2SZ6KfR
+5eSeEAJ+t49b2SaanYhZFusrn1fi8JhJQ0wi5LYfmLz/Kf4zGGZj+IgR9QmwIcLf
+-----END CERTIFICATE-----"
 
 # Option C: base64 of the PEM (safer for .env with multi-line)
 # TLS_CA_PEM_B64="BASE64_OF_PEM"