diff --git a/clients/wearos/profiles.d/example-profile.sh.example b/clients/wearos/profiles.d/example-profile.sh.example
index b8d54c0..1d13459 100644
--- a/clients/wearos/profiles.d/example-profile.sh.example
+++ b/clients/wearos/profiles.d/example-profile.sh.example
@@ -10,8 +10,12 @@
 #   (launcher label "Doctate (Dev)" + red "DEV" badge in the UI). All other
 #   profiles render the production-clean UI.
 
-# Backend URL the watch talks to. Plain HTTP is fine on the LAN.
-SERVER_URL="http://minerva.lan:3000"
+# Backend URL the watch talks to. Shared/production servers use HTTPS via the
+# public domain — a Let's Encrypt cert chains to the system trust store, so no
+# network-security-config change is needed. Plain HTTP is only for dev LAN
+# targets (e.g. the dev laptop IP), which must be allow-listed in
+# network_security_config.xml.
+SERVER_URL="https://app.doctate.de"
 
 # Plaintext api_key matching the slug in the server's users.toml.
 # Generate with: openssl rand -base64 24