diff --git a/README.md b/README.md
index eea8213..49a81db 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ LAN:              Client → split DNS  → Caddy :443 → (edge) instance conta
 - `docker-compose.yml`: Runs `caddy`, the infra tunnel `cloudflared`, and the preview tunnel `cloudflared-preview`. Caddy and `cloudflared-preview` join the external `edge` network shared with project instances; `cloudflared-preview` joins nothing else.
 - `Caddyfile`: Global options (ACME email, client-IP trust), the `cloudflare_tls` snippet, standalone sites, and `import sites/*.caddy`.
 - `sites/`: One file per project, mounted read-only at `/etc/caddy/sites`.
-  - `gig-platform.caddy`: gig-platform instances — `main` at `gig-api.kucial.com` (public name) and `gig-platform.dev.kucial.com` (LAN alias), `e2e` / `pr-<N>` by hostname label, and main's permission gates on `studio.` / `minio.` / `horizon.`.
+  - `gig-platform.caddy`: gig-platform instances — `main` at `gig-api.kucial.com` (public name) and `gig-platform.dev.kucial.com` (LAN alias), `e2e` / `pr-<N>` by hostname label, and main's permission gates on `studio.` / `objects.` / `horizon.`.
   - `gig-app.caddy`: gig-app web instances — `main` at `gig-web.kucial.com` and `gig-app.dev.kucial.com`, `pr-<N>` by label.
 - `.env`: Stores `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_TUNNEL_TOKEN` and `CLOUDFLARE_PREVIEW_TUNNEL_TOKEN`.
 - `data/`: Persistent volume storing Caddy's certificates.
@@ -81,13 +81,13 @@ Split DNS on the router must resolve both the apex and the wildcard of each proj
 | :--- | :--- | :--- |
 | `gig-api.kucial.com` | `HTTP` | `gig-platform-main-nginx:80` |
 | `gig-studio.kucial.com` | `HTTP` | `gig-platform-main-db-studio-gate:80` |
-| `gig-minio.kucial.com` | `HTTP` | `gig-platform-main-minio-console-gate:80` |
+| `gig-objectstore.kucial.com` | `HTTP` | `gig-platform-main-objectstore-console-gate:80` |
 | `gig-horizon.kucial.com` | `HTTP` | `gig-platform-main-horizon-gate:80` |
 | `gig-web.kucial.com` | `HTTP` | `gig-app-main-web:80` |
 
 **One label each, and not by preference:** the free plan's Universal SSL covers `kucial.com` and `*.kucial.com` only, so a published `something.dev.kucial.com` fails TLS at the edge however the tunnel is configured — that level needs Advanced Certificate Manager. The `dev.kucial.com` names stay LAN-only, where Caddy issues its own DNS-01 certificates and depth does not matter.
 
-- Route the internal surfaces only to their **gates**, never to `db-studio`, `minio:9001` or anything else. The gates enforce the platform permission on every request.
+- Route the internal surfaces only to their **gates**, never to `db-studio`, `objectstore:9001` or anything else. The gates enforce the platform permission on every request.
 - Never publish `*.gig-platform.dev.kucial.com` or `*.gig-app.dev.kucial.com`: PR and e2e instances are LAN-only, reached through split DNS.
 - Enable WebSockets for the zone; gig-platform serves them at `/app/` on the instance hostname.
 - A public hostname must not exist on both tunnels, or traffic goes to whichever connector wins.
diff --git a/sites/gig-platform.caddy b/sites/gig-platform.caddy
index e6e5423..22f25e8 100644
--- a/sites/gig-platform.caddy
+++ b/sites/gig-platform.caddy
@@ -24,13 +24,13 @@ gig-api.kucial.com, gig-platform.dev.kucial.com {
 	# main's internal surfaces. These labels are reserved: instance names are
 	# restricted to main, e2e and pr-<N>, so none can collide with them.
 	@studio host studio.gig-platform.dev.kucial.com
-	@minio host minio.gig-platform.dev.kucial.com
+	@objects host objects.gig-platform.dev.kucial.com
 	@horizon host horizon.gig-platform.dev.kucial.com
 	handle @studio {
 		reverse_proxy gig-platform-main-db-studio-gate:80
 	}
-	handle @minio {
-		reverse_proxy gig-platform-main-minio-console-gate:80
+	handle @objects {
+		reverse_proxy gig-platform-main-objectstore-console-gate:80
 	}
 	handle @horizon {
 		reverse_proxy gig-platform-main-horizon-gate:80