diff --git a/nginx/nginx/cloudflare_ips.conf b/nginx/nginx/cloudflare_ips.conf
index 09d3177..4034511 100644
--- a/nginx/nginx/cloudflare_ips.conf
+++ b/nginx/nginx/cloudflare_ips.conf
@@ -1,5 +1,5 @@
 # Auto-generated Cloudflare IP ranges
-# Updated: Wed May  6 10:53:55 PM PDT 2026
+# Updated: Fri Jun  5 10:57:59 PM PDT 2026
 
 real_ip_header CF-Connecting-IP;
 
diff --git a/nginx/nginx/sites-available/cipher.conf b/nginx/nginx/sites-available/cipher.conf
new file mode 100644
index 0000000..cbf9611
--- /dev/null
+++ b/nginx/nginx/sites-available/cipher.conf
@@ -0,0 +1,25 @@
+# Cipher - Bluesky collections archive.
+server {
+  listen 443 ssl;
+  server_name cipher.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/cipher.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/cipher.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/cipher;
+
+  location = / {
+    try_files /site.html =404;
+  }
+
+  location = /data.json {
+    default_type application/json;
+    add_header Content-Type "application/json; charset=utf-8";
+  }
+
+  # Everything else gets the global 404
+  location / {
+    return 404;
+  }
+
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
diff --git a/nginx/nginx/sites-available/workshops.conf b/nginx/nginx/sites-available/workshops.conf
new file mode 100644
index 0000000..edb361a
--- /dev/null
+++ b/nginx/nginx/sites-available/workshops.conf
@@ -0,0 +1,15 @@
+# Workshops Angular SPA (companion guides for live workshops).
+server {
+  listen 443 ssl;
+  server_name workshops.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/workshops.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/workshops.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/workshops/dist/workshops/browser;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  include /etc/nginx/snippets/deny-dotfiles.conf;
+}
diff --git a/nginx/nginx/sites-enabled/cipher.conf b/nginx/nginx/sites-enabled/cipher.conf
new file mode 120000
index 0000000..cfd26fe
--- /dev/null
+++ b/nginx/nginx/sites-enabled/cipher.conf
@@ -0,0 +1 @@
+../sites-available/cipher.conf
\ No newline at end of file
diff --git a/nginx/nginx/sites-enabled/workshops.conf b/nginx/nginx/sites-enabled/workshops.conf
new file mode 120000
index 0000000..70df83e
--- /dev/null
+++ b/nginx/nginx/sites-enabled/workshops.conf
@@ -0,0 +1 @@
+../sites-available/workshops.conf
\ No newline at end of file