diff --git a/.htaccess b/.htaccess
index 444b769c..57a8c6a4 100644
--- a/.htaccess
+++ b/.htaccess
@@ -1,6 +1,14 @@
 
 RewriteEngine on
 
+# ----- Canonical host -----
+# msosorg.com now serves this docroot, so consolidate ranking signals: 301
+# every other host — the old temp domain msos.spletnimojster.si, any "www.",
+# and the origin host — to the canonical bare apex over HTTPS. Runs before the
+# HTTPS-force below so the temp domain reaches the canonical in a single hop.
+RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
+RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
+
 # ----- Force HTTPS everywhere -----
 # Redirect any plain-http request to https. The two conditions together avoid
 # a redirect loop when TLS is terminated by an upstream proxy (which forwards
@@ -10,12 +18,8 @@ RewriteCond %{HTTP:X-Forwarded-Proto} !=https
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 
 # ----- Language root redirect -----
-# Send the bare root to the default-language homepage, on WHATEVER host is
-# serving the site (relative — no cross-domain redirect). Do NOT force
-# msosorg.com here: the site is currently served from msos.spletnimojster.si,
-# and msosorg.com does not yet serve these files, so forcing it 404s.
-# Once msosorg.com is pointed at this same docroot, a canonical-host redirect
-# can be added back safely.
+# Send the bare root to the default-language homepage. After the canonical-host
+# rule above, this only runs on https://msosorg.com, so it stays relative.
 RewriteRule ^/?$ /en/ [R=301,L]
 
 # ----- Defense-in-depth: block dev/sensitive files if they ever ship -----
diff --git a/docs/launch-seo-checklist.md b/docs/launch-seo-checklist.md
index 326bbbd6..17dadb16 100644
--- a/docs/launch-seo-checklist.md
+++ b/docs/launch-seo-checklist.md
@@ -22,18 +22,21 @@ this is the "flip the switch" list.
 - [ ] Confirm a valid **HTTPS certificate** (Let's Encrypt / host-provided).
 - [ ] Confirm the site loads at `https://msosorg.com/en/` (and `/mk/`, `/si/`).
 
-## 2. Redirects (`.htaccess`)
+## 2. Redirects (`.htaccess`)  ✅ done
 
-- [ ] Update the root redirect in `.htaccess` (lines 2–5): change
-      `msos.spletnimojster.si` → `msosorg.com` so `/` → `/en/` on the real host.
-- [ ] Add a **301 from the temp domain to the final domain** so any links /
-      early indexing on `msos.spletnimojster.si` pass equity to `msosorg.com`:
+- [x] Root redirect (`/` → `/en/`) is host-agnostic, so it needs no domain edit.
+- [x] **Canonical-host 301 added.** A single rule 301s every non-canonical host
+      — the temp domain `msos.spletnimojster.si`, any `www.`, and the origin
+      host — to `https://msosorg.com`, consolidating ranking signals. It runs
+      before the HTTPS-force so the temp domain reaches the canonical in one hop:
       ```apache
-      RewriteCond %{HTTP_HOST} ^(www\.)?msos\.spletnimojster\.si$ [NC]
-      RewriteRule ^(.*)$ https://msosorg.com/$1 [R=301,L]
+      RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
+      RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
       ```
-- [ ] Pick ONE host form (www vs non-www) and 301 the other to it.
-- [ ] (Ask me to make these edits — they're quick.)
+- [x] Host form chosen: **bare `msosorg.com`** (matches the hard-coded canonicals);
+      `www.` is folded into the rule above.
+- [ ] After this deploys, verify with `curl -I https://msos.spletnimojster.si/en/`
+      → `301` to `https://msosorg.com/en/`, and that `https://msosorg.com/en/` is `200`.
 
 ## 3. Verify the technical layer resolves on the real domain