diff --git a/infra/outputs.tf b/infra/outputs.tf
index 6c31660..5b21a36 100644
--- a/infra/outputs.tf
+++ b/infra/outputs.tf
@@ -3,12 +3,22 @@ output "server_ip" {
   description = "Static external IP of the DRB server VM"
 }
 
+# Bare domain, not app.<domain> — the frontend is served on the domain itself
+# (see infra/ansible/roles/deploy/templates/Caddyfile.j2). Only the bare name,
+# api. and mqtt. have DNS records; app. has never resolved.
 output "app_url" {
-  value = "https://app.${var.domain}"
+  value       = "https://${var.domain}"
+  description = "Frontend / portal URL"
 }
 
 output "api_url" {
-  value = "https://api.${var.domain}"
+  value       = "https://api.${var.domain}"
+  description = "c2-core REST API URL"
+}
+
+output "mqtt_host" {
+  value       = "mqtt.${var.domain}"
+  description = "Broker hostname edge nodes connect to on TCP 8883 (TLS)"
 }
 
 output "project_number" {