diff --git a/.env.example b/.env.example
index f9ae27e..8eec672 100644
--- a/.env.example
+++ b/.env.example
@@ -1,8 +1,8 @@
 DJANGO_SETTINGS_MODULE=config.settings.production
 DJANGO_SECRET_KEY=replace-with-a-long-random-production-secret
 DEBUG=False
-ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com
-CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com
+ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com
+CSRF_TRUSTED_ORIGINS=http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com
 
 POSTGRES_DB=com2care
 POSTGRES_USER=com2care_user
diff --git a/README.md b/README.md
index a06ca90..38b87d5 100644
--- a/README.md
+++ b/README.md
@@ -65,8 +65,8 @@ Important variables:
 | Variable | Purpose |
 |---|---|
 | `DJANGO_SECRET_KEY` | Required strong secret for production |
-| `ALLOWED_HOSTS` | Hostnames, including `com2care.com` |
-| `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://` |
+| `ALLOWED_HOSTS` | Hostnames, including `com2care.com` and `comp2care.com` |
+| `CSRF_TRUSTED_ORIGINS` | Full trusted origins with `https://`; both production domains are always included |
 | `POSTGRES_DB` | PostgreSQL database name |
 | `POSTGRES_USER` | PostgreSQL user |
 | `POSTGRES_PASSWORD` | PostgreSQL password |
diff --git a/config/settings/production.py b/config/settings/production.py
index 2aedb58..9827302 100644
--- a/config/settings/production.py
+++ b/config/settings/production.py
@@ -6,7 +6,21 @@ SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
 
 DEBUG = False
 
-ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")
+PRODUCTION_HOSTS = {
+    "com2care.com",
+    "www.com2care.com",
+    "comp2care.com",
+    "www.comp2care.com",
+}
+
+ALLOWED_HOSTS = sorted(
+    PRODUCTION_HOSTS
+    | {
+        host.strip()
+        for host in os.environ.get("ALLOWED_HOSTS", "").split(",")
+        if host.strip()
+    }
+)
 
 SECURE_HSTS_SECONDS = 31536000
 SECURE_HSTS_INCLUDE_SUBDOMAINS = True
@@ -18,8 +32,11 @@ SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = "DENY"
 
-CSRF_TRUSTED_ORIGINS = [
-    origin.strip()
-    for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
-    if origin.strip()
-]
+CSRF_TRUSTED_ORIGINS = sorted(
+    {f"https://{host}" for host in PRODUCTION_HOSTS}
+    | {
+        origin.strip()
+        for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
+        if origin.strip()
+    }
+)
diff --git a/docker-compose.yml b/docker-compose.yml
index 71ec049..0413dd2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -22,8 +22,8 @@ services:
     environment:
       DJANGO_SETTINGS_MODULE: ${DJANGO_SETTINGS_MODULE:-config.settings.production}
       DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-django-insecure-local-com2care-change-in-production}
-      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com}
-      CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com}
+      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1,0.0.0.0,com2care.com,www.com2care.com,comp2care.com,www.comp2care.com}
+      CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:-http://localhost:8000,https://com2care.com,https://www.com2care.com,https://comp2care.com,https://www.comp2care.com}
       SECURE_SSL_REDIRECT: ${SECURE_SSL_REDIRECT:-False}
       POSTGRES_DB: ${POSTGRES_DB:-com2care}
       POSTGRES_USER: ${POSTGRES_USER:-com2care_user}