diff --git a/fe/ac-fe-upstream.conf b/fe/ac-fe-upstream.conf
new file mode 100644
index 0000000..ce1a540
--- /dev/null
+++ b/fe/ac-fe-upstream.conf
@@ -0,0 +1,9 @@
+# Shared cluster upstream — include in http {} before apps.conf / ac-fe.conf.
+# STAGING/DEV: cast01–03 lab cluster (no artc0).
+
+upstream ac_be_backend {
+	server cast01.intra.raptor.org:80;
+	server cast02.intra.raptor.org:80 backup;
+	server cast03.intra.raptor.org:80 backup;
+	keepalive 8;
+}
diff --git a/fe/ac-fe.conf b/fe/ac-fe.conf
index 37f54d5..b53264a 100644
--- a/fe/ac-fe.conf
+++ b/fe/ac-fe.conf
@@ -1,20 +1,13 @@
-# Android Cast FE — lab cluster + optional prod upstream switch.
+# Android Cast FE — staging cluster (cast01–03). No artc0 upstream.
 # Target install on Gentoo FE (monstro):  /etc/nginx/ac-fe.conf
-# Enable: add to /etc/nginx/nginx.conf (http {}), after apps.conf:
+# Enable in /etc/nginx/nginx.conf (http {}):
+#   include /etc/nginx/ac-fe-upstream.conf;
+#   include /etc/nginx/apps.conf;
 #   include /etc/nginx/ac-fe.conf;
 #
 # Reload:  nginx -t && rc-service nginx reload
-#
-# Upstream: lab = cast01 cluster nginx :80; prod = artc0 BE :80.
-# Edit ac_be_backend below before reload when cutting prod apps.f0xx.org to /issues/.
 
-upstream ac_be_backend {
-	server cast01.intra.raptor.org:80;
-	server cast02.intra.raptor.org:80 backup;
-	server cast03.intra.raptor.org:80 backup;
-	# server artc0.intra.raptor.org:80;   # prod cutover — uncomment and comment lab lines
-	keepalive 8;
-}
+# upstream ac_be_backend — see ac-fe-upstream.conf (shared with apps.f0xx.org)
 
 # --- Lab public names (DNS → monstro FE → cluster BE) ---
 # cluster.env: acl0.f0xx.org, c1–c3.acl0.f0xx.org
diff --git a/fe/apps.conf b/fe/apps.conf
new file mode 100644
index 0000000..607ea6a
--- /dev/null
+++ b/fe/apps.conf
@@ -0,0 +1,118 @@
+# apps.f0xx.org — Android Cast public vhost (FE Gentoo).
+# Install: /etc/nginx/apps.conf (symlink or copy from ac-platform-edge/fe/apps.conf)
+# Requires: include /etc/nginx/ac-fe-upstream.conf; in http {} (upstream ac_be_backend).
+#
+# Upstream: cast01–03 lab cluster (:80). Legacy artc0 BE is deprecated.
+# Reload:  nginx -t && rc-service nginx reload
+
+server {
+	listen 80;
+	server_name apps.f0xx.org;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	listen 443 ssl http2;
+	server_name apps.f0xx.org;
+
+	access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
+	error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
+
+	ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
+
+	location ^~ /v0/ota/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project/build {
+		return 301 $scheme://$host/app/androidcast_project/build/;
+	}
+	location ^~ /app/androidcast_project/build/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	include /etc/nginx/ac-fe.fragment;
+
+	location = /app/androidcast_project/graphs {
+		return 301 $scheme://$host/app/androidcast_project/graphs/;
+	}
+	location ^~ /app/androidcast_project/graphs/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project {
+		return 301 $scheme://$host/app/androidcast_project/;
+	}
+	location ^~ /app/androidcast_project/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	location = /app/androidcast_project/git {
+		return 301 $scheme://$host/app/androidcast_project/git/;
+	}
+	location ^~ /app/androidcast_project/git/ {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	location / {
+		proxy_pass http://ac_be_backend;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_connect_timeout 120s;
+		proxy_send_timeout 120s;
+		proxy_read_timeout 180s;
+		proxy_buffers 16 16m;
+		proxy_buffer_size 16m;
+		client_body_buffer_size 16m;
+		client_max_body_size 16m;
+		proxy_buffering off;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_cache_bypass $http_upgrade;
+	}
+
+	location ~ /\.ht {
+		deny all;
+	}
+}