diff --git a/.env.example b/.env.example
index 40cebb1..d8f5a63 100644
--- a/.env.example
+++ b/.env.example
@@ -1,2 +1,3 @@
 COMPOSE_PROJECT_NAME=nullcart_promo_prod
 CLEARNET_DOMAIN=nullcart.net
+ONION_HOSTNAME=samplexxxxxxxxx.onion
diff --git a/README.md b/README.md
index 614c238..b8243b9 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,14 @@ Save and exit the editor. Optional — run once manually to verify:
 ./deploy/scripts/show-onion.sh
 ```
 
+Copy the hostname into `.env.prod` as `ONION_HOSTNAME`, then recreate nginx:
+
+```bash
+docker compose --env-file .env.prod -f docker-compose.prod.yml up -d --force-recreate nginx
+```
+
+Tor Browser will then show ".onion available" when visitors open the clearnet site over HTTPS.
+
 ### 9. Updates
 
 ```bash
diff --git a/nginx/conf.d/clearnet.conf.template b/nginx/conf.d/clearnet.conf.template
index 1bed760..6f47c1c 100644
--- a/nginx/conf.d/clearnet.conf.template
+++ b/nginx/conf.d/clearnet.conf.template
@@ -18,6 +18,8 @@ server {
     ssl_certificate /etc/nginx/certs/live/${CLEARNET_DOMAIN}/fullchain.pem;
     ssl_certificate_key /etc/nginx/certs/live/${CLEARNET_DOMAIN}/privkey.pem;
 
+    ${ONION_LOCATION_HEADER}
+
     root /usr/share/nginx/html;
     index index.html;
 
diff --git a/nginx/docker-entrypoint.sh b/nginx/docker-entrypoint.sh
index 0116f5f..703c5ba 100755
--- a/nginx/docker-entrypoint.sh
+++ b/nginx/docker-entrypoint.sh
@@ -2,7 +2,14 @@
 set -eu
 
 export CLEARNET_DOMAIN
-envsubst '${CLEARNET_DOMAIN}' \
+
+if [ -n "${ONION_HOSTNAME:-}" ]; then
+    export ONION_LOCATION_HEADER="add_header Onion-Location \"http://${ONION_HOSTNAME}\$request_uri\";"
+else
+    export ONION_LOCATION_HEADER=""
+fi
+
+envsubst '${CLEARNET_DOMAIN} ${ONION_LOCATION_HEADER}' \
     < /etc/nginx/templates/conf.d/clearnet.conf.template \
     > /etc/nginx/conf.d/clearnet.conf