diff --git a/server/lib/traefik/TraefikConfigManager.ts b/server/lib/traefik/TraefikConfigManager.ts
index bc1bac221..c8b48878f 100644
--- a/server/lib/traefik/TraefikConfigManager.ts
+++ b/server/lib/traefik/TraefikConfigManager.ts
@@ -358,7 +358,7 @@ export class TraefikConfigManager {
                 this.lastActiveDomains = new Set(domains);
             }
 
-            if (process.env.USE_PANGOLIN_DNS === "true" && build != "oss") {
+            if (process.env.CERT_MODE === "pangolin" && build != "oss") {
                 // Scan current local certificate state
                 this.lastLocalCertificateState =
                     await this.scanLocalCertificateState();
diff --git a/server/private/dns.ts b/server/private/dns.ts
index 8bc04fadc..d5401c355 100644
--- a/server/private/dns.ts
+++ b/server/private/dns.ts
@@ -17,14 +17,8 @@ import { privateConfig } from "#private/lib/config";
 let dnsServer: AuthoritativeDNSServer | undefined;
 
 export async function startDnsServer() {
-    const use_pangolin_dns =
-        privateConfig.getRawPrivateConfig().flags.use_pangolin_dns;
-    if (!use_pangolin_dns) {
-        return;
-    }
-
     const dnsConfig = privateConfig.getRawPrivateConfig().dns;
-    if (!dnsConfig) {
+    if (!dnsConfig || !dnsConfig.enabled) {
         return;
     }
 
diff --git a/server/private/lib/config.ts b/server/private/lib/config.ts
index 0e9f8fddb..6b225c36b 100644
--- a/server/private/lib/config.ts
+++ b/server/private/lib/config.ts
@@ -146,6 +146,10 @@ export class PrivateConfig {
             process.env.USE_PANGOLIN_DNS =
                 this.rawPrivateConfig.flags.use_pangolin_dns.toString();
         }
+
+        if (this.rawPrivateConfig.acme?.cert_mode) {
+            process.env.CERT_MODE = this.rawPrivateConfig.acme.cert_mode;
+        }
     }
 
     public getRawPrivateConfig() {
diff --git a/server/private/lib/readConfigFile.ts b/server/private/lib/readConfigFile.ts
index c222d52de..b4606a0b2 100644
--- a/server/private/lib/readConfigFile.ts
+++ b/server/private/lib/readConfigFile.ts
@@ -97,6 +97,7 @@ export const privateConfigSchema = z
             .optional(),
         dns: z
             .object({
+                enabled: z.boolean().optional().default(false),
                 listen_port: z.number(),
                 nameserver_name: z.string(),
                 cname_extension: z.string(),
@@ -188,14 +189,26 @@ export const privateConfigSchema = z
             })
             .optional()
             .prefault({}),
-        // @deprecated Moved to the public config file as `acme`
-        // (server/lib/readConfigFile.ts). Kept here only so existing private
-        // config files keep parsing; any value set here is migrated into the
-        // public config at startup by PrivateConfig (server/private/lib/config.ts).
         acme: z
             .object({
+                cert_mode: z
+                    .enum(["traefik", "pangolin"])
+                    .optional()
+                    .default("traefik"),
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_json_path: z.string().optional(),
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_http_endpoint: z.string().optional(),
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 sync_interval_ms: z.number().optional()
             })
             .optional(),
diff --git a/server/private/lib/traefik/getTraefikConfig.ts b/server/private/lib/traefik/getTraefikConfig.ts
index 0515b8265..43a325734 100644
--- a/server/private/lib/traefik/getTraefikConfig.ts
+++ b/server/private/lib/traefik/getTraefikConfig.ts
@@ -396,7 +396,7 @@ export async function getTraefikConfig(
         );
 
     let validCerts: CertificateResult[] = [];
-    if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+    if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
         // create a list of all domains to get certs for
         const domains = new Set<string>();
         for (const resource of resourcesMap.values()) {
@@ -522,7 +522,10 @@ export async function getTraefikConfig(
             );
 
             let tls = {};
-            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+            if (
+                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                "pangolin"
+            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!resource.subdomain,
@@ -789,7 +792,8 @@ export async function getTraefikConfig(
                 preferWildcardCert
             }) => {
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     return buildWildcardTls({
                         fullDomain,
@@ -832,7 +836,8 @@ export async function getTraefikConfig(
             redirectHttpsMiddlewareName,
             resolveTls: (fullDomain) => {
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -924,7 +929,10 @@ export async function getTraefikConfig(
             const rule = buildHostRule(fullDomain, ir.wildcard);
 
             let tls: any = {};
-            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+            if (
+                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                "pangolin"
+            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!ir.subdomain,
@@ -1005,7 +1013,8 @@ export async function getTraefikConfig(
 
                 let tls: any = {};
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -1080,7 +1089,7 @@ export async function getTraefikConfig(
             .where(eq(exitNodes.exitNodeId, exitNodeId));
 
         let validCertsLoginPages: CertificateResult[] = [];
-        if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+        if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
             // create a list of all domains to get certs for
             const domains = new Set<string>();
             for (const lp of exitNodeLoginPages) {
@@ -1126,7 +1135,8 @@ export async function getTraefikConfig(
 
                 const tls = {};
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // TODO: we need to add the wildcard logic here too
                 } else {
diff --git a/src/lib/pullEnv.ts b/src/lib/pullEnv.ts
index 842ff2967..3d6dedee5 100644
--- a/src/lib/pullEnv.ts
+++ b/src/lib/pullEnv.ts
@@ -1,3 +1,4 @@
+import { build } from "@server/build";
 import { Env } from "./types/env";
 
 export function pullEnv(): Env {
@@ -34,9 +35,7 @@ export function pullEnv(): Env {
                         : false
             },
             identityProviderMode: process.env.IDENTITY_PROVIDER_MODE as
-                | "org"
-                | "global"
-                | undefined
+                "org" | "global" | undefined
         },
         email: {
             emailEnabled: process.env.EMAIL_ENABLED === "true" ? true : false