diff --git a/README.md b/README.md
index e2d903f..8090217 100644
--- a/README.md
+++ b/README.md
@@ -106,7 +106,9 @@ login: Block staging, public staging, or public production. Block production
 does not currently deploy Blox. Override the endpoint with
 `bl compute --base-url <url> list` or `BL_BLOX_CONTROL_PLANE_URL`. The CLI accepts
 only the approved HTTPS ingress origins `blox.test.blockstaging.build`,
-`blox.public.builderlabstaging.xyz`, and `blox.public.builderlab.xyz`.
+`blox.public.builderlabstaging.xyz`, and `blox.builderlab.xyz`. Public production
+defaults to `https://blox.builderlab.xyz`; the legacy
+`blox.public.builderlab.xyz` origin remains accepted for explicit overrides.
 
 The CLI verifies the same stored session used by the other BuilderLab commands
 and sends it as `Authorization: BBIdentity` to Blox ingress. No additional
diff --git a/src/bl/blox/context.rs b/src/bl/blox/context.rs
index 201b4c0..6fa2017 100644
--- a/src/bl/blox/context.rs
+++ b/src/bl/blox/context.rs
@@ -12,6 +12,7 @@ const APPROVED_HOSTS: &[&str] = &[
     "blox.test.blockstaging.build",
     "blox.public.builderlabstaging.xyz",
     "blox.public.builderlab.xyz",
+    "blox.builderlab.xyz",
 ];
 
 pub(super) fn args(command: Command) -> Command {
@@ -96,7 +97,7 @@ fn default_endpoint(auth_base_url: &str) -> Result<String> {
     let endpoint = match origin.as_str() {
         "https://test.blockstaging.build" => "https://blox.test.blockstaging.build",
         "https://app.builderlabstaging.xyz" => "https://blox.public.builderlabstaging.xyz",
-        "https://app.builderlab.xyz" => "https://blox.public.builderlab.xyz",
+        "https://app.builderlab.xyz" => "https://blox.builderlab.xyz",
         "https://block.builderlab.xyz" => return Err(failure(exit_codes::GENERAL, "blox_unavailable", "Blox is not deployed in this BuilderLab environment")),
         _ => return Err(failure(exit_codes::GENERAL, "endpoint_required", "No Blox endpoint is configured for this BuilderLab environment; set an approved ingress with --base-url or BL_BLOX_CONTROL_PLANE_URL")),
     };
@@ -161,14 +162,12 @@ mod tests {
                 "https://app.builderlabstaging.xyz",
                 "https://blox.public.builderlabstaging.xyz",
             ),
-            (
-                "https://app.builderlab.xyz",
-                "https://blox.public.builderlab.xyz",
-            ),
+            ("https://app.builderlab.xyz", "https://blox.builderlab.xyz"),
         ] {
             assert_eq!(default_endpoint(auth).unwrap(), blox);
             assert!(validate_endpoint(blox).is_ok());
         }
+        assert!(validate_endpoint("https://blox.public.builderlab.xyz").is_ok());
         assert!(default_endpoint("https://block.builderlab.xyz")
             .unwrap_err()
             .to_string()
@@ -192,6 +191,13 @@ mod tests {
             "https://blox.public.builderlab.xyz/path",
             "https://blox.public.builderlab.xyz/?q=1",
             "https://blox.public.builderlab.xyz/#fragment",
+            "http://blox.builderlab.xyz",
+            "https://blox.builderlab.xyz:8443",
+            "https://blox.builderlab.xyz.evil.test",
+            "https://user@blox.builderlab.xyz",
+            "https://blox.builderlab.xyz/path",
+            "https://blox.builderlab.xyz/?q=1",
+            "https://blox.builderlab.xyz/#fragment",
             "http://127.0.0.1:8895",
         ] {
             assert!(validate_endpoint(endpoint).is_err(), "accepted {endpoint}");
diff --git a/src/bl/blox/list.rs b/src/bl/blox/list.rs
index 8c945fc..bf95fa9 100644
--- a/src/bl/blox/list.rs
+++ b/src/bl/blox/list.rs
@@ -105,7 +105,7 @@ mod tests {
                 &[
                     namespace,
                     "--base-url",
-                    "https://blox.public.builderlab.xyz",
+                    "https://blox.builderlab.xyz",
                     "list",
                     "--include-deleted",
                     "--limit",