diff --git a/.github/README.coolify.md b/.github/README.coolify.md
index ea385871..b20a9b01 100644
--- a/.github/README.coolify.md
+++ b/.github/README.coolify.md
@@ -24,10 +24,11 @@ daily; the Coolify-specific patch lives in
 
 ## Optional: separate admin domain
 
-Set `ADMIN_DOMAIN=admin.example.com` on the resource and add the same value
-as a second FQDN on the `ghost` service in Coolify. Upstream's
-`${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}}` expression means Ghost sees
-`admin__url` only when the variable is non-empty.
+Set `admin__url` on the resource to the full admin URL
+(e.g. `https://admin.example.com`) and add the same domain as a second FQDN
+on the `ghost` service in Coolify. When `admin__url` is left empty Ghost
+falls back to the primary URL, so you only need to touch this row if you
+actually want a separate admin host.
 
 ## Optional: analytics (Tinybird)
 
diff --git a/.github/scripts/patch.py b/.github/scripts/patch.py
index ce55c0b4..4b545127 100644
--- a/.github/scripts/patch.py
+++ b/.github/scripts/patch.py
@@ -132,6 +132,19 @@ def patch_compose() -> None:
         "activitypub.LOCAL_STORAGE_HOSTING_URL",
     )
 
+    # admin_url: Coolify's env-var scanner mis-parses upstream's nested
+    # ${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}} conditional, surfacing a
+    # garbage "ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}" row in the UI.
+    # Replace with a simple ${admin__url:-$SERVICE_URL_GHOST} default so
+    # Coolify sees one clean editable row, and Ghost always gets a valid
+    # URL (falls back to the primary FQDN when admin_url is unset).
+    c = swap(
+        c,
+        "admin__url: ${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}}",
+        "admin__url: ${admin__url:-$SERVICE_URL_GHOST}",
+        "admin__url Coolify-friendly",
+    )
+
     # Ghost healthcheck (inserted between env_file and environment)
     ghost_env_anchor = (
         "    # This is required to import current config when migrating\n"
diff --git a/.github/scripts/test-patch.sh b/.github/scripts/test-patch.sh
index 848374b1..d9442068 100755
--- a/.github/scripts/test-patch.sh
+++ b/.github/scripts/test-patch.sh
@@ -23,6 +23,13 @@ touch caddy/Caddyfile.example caddy/snippets/Logging .env
 cp "$REPO_ROOT/.github/README.coolify.md" .github/
 cp "$REPO_ROOT/.github/scripts/patch.py" .
 
+assert_absent() {
+  if grep -qE "$1" compose.yml; then
+    echo "unexpected match for /$1/ in compose.yml" >&2
+    exit 1
+  fi
+}
+
 echo "→ run 1: apply patch"
 python3 patch.py
 
@@ -45,16 +52,11 @@ grep -qF 'mail__options__host: ${mail__options__host:-}' compose.yml
 # shellcheck disable=SC2016
 grep -qF 'mail__from: ${mail__from:-}' compose.yml
 
-echo "→ assert ADMIN_DOMAIN kept upstream :+ conditional"
+echo "→ assert admin_url rewritten to Coolify-friendly form"
 # shellcheck disable=SC2016  # literal compose syntax, no shell expansion wanted
-grep -qF '${ADMIN_DOMAIN:+https://${ADMIN_DOMAIN}}' compose.yml
-
-assert_absent() {
-  if grep -qE "$1" compose.yml; then
-    echo "unexpected match for /$1/ in compose.yml" >&2
-    exit 1
-  fi
-}
+grep -qF 'admin__url: ${admin__url:-$SERVICE_URL_GHOST}' compose.yml
+# Old :+ conditional must be gone (Coolify mis-parses the nested form)
+assert_absent 'ADMIN_DOMAIN:\+'
 
 echo "→ assert DOMAIN and DATABASE_* refs gone from compose.yml"
 assert_absent '\$\{DOMAIN(:[^}]*)?\}'