diff --git a/scripts/pma-gateway/create_pma_gateway.sh b/scripts/pma-gateway/create_pma_gateway.sh
index 8b888bb..bb00d7c 100644
--- a/scripts/pma-gateway/create_pma_gateway.sh
+++ b/scripts/pma-gateway/create_pma_gateway.sh
@@ -41,16 +41,27 @@ fi
 # 1) explicit --cert-domain
 # 2) JELASTIC_ENV_DOMAIN
 # 3) hostname-derived domain
+# Additionally, if a legacy *.sites.mightybox.dev candidate is seen,
+# derive *.sites.mightybox.cloud as a compatibility fallback.
 HOSTNAME_DOMAIN=$(hostname -f)
 HOSTNAME_DOMAIN=${HOSTNAME_DOMAIN#node*-}
 
 DOMAIN_CANDIDATES=()
 SEEN_DOMAINS="|"
 for candidate in "$CERT_DOMAIN" "${JELASTIC_ENV_DOMAIN:-}" "$HOSTNAME_DOMAIN"; do
-  if [[ -n "$candidate" ]] && [[ "$SEEN_DOMAINS" != *"|$candidate|"* ]]; then
+  if [[ -n "$candidate" ]] && [[ "$candidate" != *'${'* ]] && [[ "$SEEN_DOMAINS" != *"|$candidate|"* ]]; then
     DOMAIN_CANDIDATES+=("$candidate")
     SEEN_DOMAINS="${SEEN_DOMAINS}${candidate}|"
   fi
+
+  if [[ "$candidate" == *.sites.mightybox.dev ]]; then
+    cloud_candidate="${candidate%.sites.mightybox.dev}.sites.mightybox.cloud"
+    if [[ -n "$cloud_candidate" ]] && [[ "$SEEN_DOMAINS" != *"|$cloud_candidate|"* ]]; then
+      DOMAIN_CANDIDATES+=("$cloud_candidate")
+      SEEN_DOMAINS="${SEEN_DOMAINS}${cloud_candidate}|"
+      echo "INFO: Added cloud fallback domain candidate '$cloud_candidate' from legacy '$candidate'." >&2
+    fi
+  fi
 done
 
 # Never use legacy *.sites.mightybox.dev domains for PMA gateway certificates.