diff --git a/QUALIFICATION.md b/QUALIFICATION.md
index f4369c9..2056120 100644
--- a/QUALIFICATION.md
+++ b/QUALIFICATION.md
@@ -1,5 +1,20 @@
 # Multi-user Hermes migration — qualification and operations
 
+## iPhone certificate onboarding follow-up — 2026-10-01
+
+User reported certificate error at iOS sign-in. Current pinned native HTTPS probe
+passed on the physical phone, while deleted John Doe account correctly returned401.
+User confirmed deleting the disposable account; do not recreate it. Prior receipts
+below describe historical qualification, not current John account existence.
+
+User approved public certificate trust onboarding. Exact nginx route
+`/hope-server.mobileconfig` serves only `/etc/voice/certs/hope-server.mobileconfig`
+from persistent certificate mount with `application/x-apple-aspen-config` and
+`Cache-Control: no-store`. It is a verified public certificate profile, no keys or
+credentials; requires manual iOS profile installation + full trust for WSS. Private
+key URL remains404. Do not expose the entire cert directory. Initial container-copy
+profile disappeared during intervening deployment; persistent alias fixed it.
+
 ## Deployment
 
 Target: Unraid `192.168.86.2`, public UI `https://192.168.86.2:9178`.
diff --git a/nginx.conf b/nginx.conf
index 3736493..ba62dca 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -7,6 +7,14 @@ server {
 
     client_max_body_size 16k;
 
+    # Public certificate-only onboarding profile lives in the persistent cert
+    # mount. Never expose that directory: it also contains the private key.
+    location = /hope-server.mobileconfig {
+        alias /etc/voice/certs/hope-server.mobileconfig;
+        default_type application/x-apple-aspen-config;
+        add_header Cache-Control "no-store";
+    }
+
     location = /token {
         proxy_pass http://127.0.0.1:8091/token;
         proxy_set_header Host $host;