diff --git a/scripts/setup/officer-setup/lib/env.sh b/scripts/setup/officer-setup/lib/env.sh
index 80c98411..b4d7ec1a 100644
--- a/scripts/setup/officer-setup/lib/env.sh
+++ b/scripts/setup/officer-setup/lib/env.sh
@@ -88,9 +88,14 @@ ENVF
 # The tailnet is where Officer is actually reached — it is the perimeter the
 # whole security model rests on — so its address is the honest default.
 #
-# MagicDNS name preferred over the raw 100.x address. Both work, but the name
-# survives the node being re-registered and reads as something a person can type,
-# and PUBLIC_URL ends up baked into the page's OpenGraph tags by `bun gen:index`.
+# The SHORT MagicDNS name — `officer-dev`, not `officer-dev.ts.example.dev` and
+# not the raw 100.x address. All three resolve inside the tailnet; the short one
+# is the one anybody actually types, and PUBLIC_URL ends up baked into the page's
+# OpenGraph tags by `bun gen:index`, so it is read by people as well as machines.
+#
+# It relies on the tailnet's search domain, which every Tailscale client sets when
+# MagicDNS is on. A device that has somehow lost it resolves the FQDN and not the
+# short name — the fix there is to type the longer one, not to default to it.
 #
 # Falls back to localhost when there is no tailnet, which is correct rather than
 # merely tolerable: a machine with no private network has no other address that
@@ -98,7 +103,8 @@ ENVF
 tailnet_hostname() {
   local dns ip
   dns="$(tailscale status --json 2>/dev/null | grep -oP '"DNSName":\s*"\K[^"]+' | head -1)"
-  dns="${dns%.}"
+  dns="${dns%.}"      # MagicDNS reports it fully qualified, with a trailing dot
+  dns="${dns%%.*}"    # and we want the short name
   if [[ -n "$dns" ]]; then
     echo "$dns"
     return 0