diff --git a/.gitignore b/.gitignore
index 7ce894f7..50b32c7e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,6 @@ codesign.p12
 !/.claude/skills/
 /scripts/l10n/missing-translations.json
 /ai/output/
+# alt-tab-free [depaywall]: the Sparkle feed is published OUT OF TREE to the gh-pages branch by
+# scripts/update_appcast.sh; the in-tree appcast.xml is removed (PLAN §3.3).
+/appcast.xml
diff --git a/Info.plist b/Info.plist
index 9f9bfbbf..120c2619 100644
--- a/Info.plist
+++ b/Info.plist
@@ -64,8 +64,8 @@
 	     Auto-checks stay off (below) until DOMAIN serves a real appcast host. -->
 	<string>1YfoCJDk/T8GQx1Gpf3O4ApFgDkBiN6oe/z/Kfnxs/M=</string>
 	<key>SUEnableAutomaticChecks</key>
-	<!-- alt-tab-free: off until DOMAIN serves a real appcast (avoids failed update checks). -->
-	<string>false</string>
+	<!-- alt-tab-free: enabled 2026-06-16 — DOMAIN serves the appcast on GitHub Pages (gh-pages). -->
+	<string>true</string>
 	<key>SUScheduledCheckInterval</key>
 	<string>604800</string>
 
diff --git a/appcast.xml b/appcast.xml
deleted file mode 100644
index 227bd582..00000000
--- a/appcast.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" standalone="yes"?>
-<!--
-  alt-tab-free [depaywall]: this in-tree appcast.xml has been TRUNCATED to an empty Sparkle feed
-  skeleton. The fork publishes its real Sparkle feed OUT OF TREE (the gh-pages branch) via
-  scripts/update_appcast.sh, so the live entries are NOT served from this tracked file (PLAN §3.3).
-
-  OWNER ACTION (before publish): `git rm appcast.xml` and add `/appcast.xml` to .gitignore (the
-  identity agent owns .gitignore). Serving the feed from the tree would (1) conflict on every
-  upstream + fork release and (2) re-introduce lwouis-key-signed entries the fork's SUPublicEDKey
-  cannot verify. It is left present-but-empty only so the tree stays buildable until removed.
--->
-<rss xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle" version="2.0">
-  <channel>
-    <title>alt-tab-free</title>
-    <language>en</language>
-  </channel>
-</rss>
diff --git a/config/local.xcconfig b/config/local.xcconfig
index 65f7e5ab..e52222fe 100644
--- a/config/local.xcconfig
+++ b/config/local.xcconfig
@@ -30,16 +30,13 @@ PRODUCT_BUNDLE_IDENTIFIER = com.koftwentytwo.commandtabfree
 CURRENT_PROJECT_VERSION = 0.0.0
 
 // --- Hosts (overrides base.xcconfig :20-21) ---
-// OWNER-OVERRIDABLE-BEFORE-PUBLISH: fork-owned hosts.
-// TODO: replace fork.invalid with the fork's real web host. DOMAIN must serve
-//       https://<DOMAIN>/appcast.xml (Sparkle feed) and /support, or update checks /
-//       the in-app Support affordance 404. fork.invalid is a deliberately NON-routable
-//       placeholder (RFC 6761 reserved .invalid TLD) so nothing phones home before publish.
-DOMAIN = fork.invalid
-// TODO: API_DOMAIN drives the user-feedback POST (FeedbackWindow). The activate
-//       fingerprint POST is closed separately at the handleCustomUrl handler (§2/§3.4),
-//       so this may be made ROUTABLE for feedback without re-arming exfiltration.
-//       Decide feedback strategy at bootstrap (§3.4 option a/b/c).
+// DOMAIN serves the Sparkle appcast at https://<DOMAIN>/appcast.xml. Set 2026-06-16 to the repo's
+// GitHub Pages site (gh-pages branch, published by scripts/update_appcast.sh). A kof22.com custom
+// domain can be added later — GitHub redirects the github.io URL, so shipped builds keep updating.
+// (/support still 404s here — harmless until a support page exists.)
+DOMAIN = koftwentytwo.github.io/CommandTabFree
+// API_DOMAIN drives the user-feedback POST (FeedbackWindow) — left NON-routable: feedback is deferred
+// (§3.4). The activate fingerprint POST is closed separately at the handleCustomUrl handler.
 API_DOMAIN = fork.invalid/api
 
 // --- Code signing (overrides release.xcconfig :5) ---