diff --git a/infrastructure/scripts/render-nginx-ssl.sh b/infrastructure/scripts/render-nginx-ssl.sh
new file mode 100755
index 0000000..e539f75
--- /dev/null
+++ b/infrastructure/scripts/render-nginx-ssl.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INFRA_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$INFRA_DIR"
+
+if [ ! -f .env ]; then
+  echo "Missing .env — copy deploy.prod.env.example to .env and edit."
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+
+: "${DOMAIN:?Set DOMAIN in .env}"
+
+mkdir -p nginx/generated
+export DOMAIN
+envsubst '${DOMAIN}' < nginx/nginx.ssl.conf.template > nginx/generated/default.conf
+echo "Rendered nginx/generated/default.conf for ${DOMAIN}"