diff --git a/servers/kid/docker-compose.d/custom/cryptpad/conf.d/cryptpad.conf b/servers/kid/docker-compose.d/custom/cryptpad/conf.d/cryptpad.conf
index 4a16db0..b14af9d 100644
--- a/servers/kid/docker-compose.d/custom/cryptpad/conf.d/cryptpad.conf
+++ b/servers/kid/docker-compose.d/custom/cryptpad/conf.d/cryptpad.conf
@@ -21,7 +21,7 @@ server {
     # In the event of an XSS vulnerability in CryptPad's front-end code
     # this will limit the amount of information accessible to attackers.
     set $main_domain "pad.ixvd.net";
-    set $sandbox_domain "pad.sandbox.neo.ixvd.net";
+    set $sandbox_domain "sandbox.pad.ixvd.net";
 
     # By default CryptPad allows remote domains to embed CryptPad documents in iframes.
     # This behaviour can be blocked by changing $allowed_origins from "*" to the
@@ -44,7 +44,7 @@ server {
     set $files_domain "${main_domain}";
 
     # nginx doesn't let you set server_name via variables, so you need to hardcore your domains here
-    server_name pad.ixvd.net pad.sandbox.neo.ixvd.net;
+    server_name pad.ixvd.net sandbox.pad.ixvd.net;
 
     # You'll need to Set the path to your certificates and keys here
     # IMPORTANT: this config is intended to serve assets for at least two domains
diff --git a/servers/kid/docker-compose.d/custom/cryptpad/config.js b/servers/kid/docker-compose.d/custom/cryptpad/config.js
index 83c439a..2ecc0d6 100644
--- a/servers/kid/docker-compose.d/custom/cryptpad/config.js
+++ b/servers/kid/docker-compose.d/custom/cryptpad/config.js
@@ -1,7 +1,7 @@
 module.exports = {
     // hosting opts
     httpUnsafeOrigin: 'https://pad.ixvd.net', // main site
-    httpSafeOrigin: "https://pad.sandbox.neo.ixvd.net", // sandbox
+    httpSafeOrigin: "https://sandbox.pad.ixvd.net", // sandbox
     httpAddress: '::', // listen on
     httpPort: 3000, // main port
     httpSafePort: 3001, // sandbox port