diff --git a/sso-mfa/k8s/keycape/register-coulomb-social.py b/sso-mfa/k8s/keycape/register-coulomb-social.py
index b940bd6..88ffae1 100755
--- a/sso-mfa/k8s/keycape/register-coulomb-social.py
+++ b/sso-mfa/k8s/keycape/register-coulomb-social.py
@@ -20,7 +20,9 @@ CLIENT = {
     "redirectUris": [
         "http://127.0.0.1:8008/auth/callback/",
         "http://localhost:8008/auth/callback/",
-        # Production host (register only when TLS + app deploy ready)
+        # Parallel public host while apex coulomb.social remains Bubble
+        "https://app.coulomb.social/auth/callback/",
+        # Future apex cutover (keep registered; not the live app host yet)
         "https://coulomb.social/auth/callback/",
     ],
     "allowedScopes": ["openid", "profile", "email", "groups"],