diff --git a/114_koillection_deployment.md b/114_koillection_deployment.md
index f0e4e1e..80e9436 100644
--- a/114_koillection_deployment.md
+++ b/114_koillection_deployment.md
@@ -1,6 +1,6 @@
 # 114 — Koillection Deployment Guide
 
-> Status: **IN PROGRESS** — CT created 2026-08-11, app stack deployed and running, nginx/SSL/DNS/Authelia pending (Phase 6+)
+> Status: **IN PROGRESS** — CT created 2026-08-11, app stack + nginx reverse proxy live on HTTP, SSL/DNS/Authelia pending (Phase 7+)
 > CT ID: 114 · IP: 192.168.1.114
 > Domain: `collections.spendlik.sk`
 > Last updated: 2026-08-11
@@ -230,7 +230,7 @@ Expect both containers `healthy`, and the curl to show `HTTP/1.1 302 Found` with
 
 ---
 
-## Phase 6 — nginx Reverse Proxy (CT 101)
+## Phase 6 — nginx Reverse Proxy (CT 101) ✅ DONE (2026-08-11)
 
 Enter CT 101 — this must be done **on CT 101**, not CT 114. nginx does not and should not exist on CT 114 itself.
 
@@ -268,7 +268,7 @@ ln -s /etc/nginx/sites-available/collections.spendlik.sk /etc/nginx/sites-enable
 nginx -t && systemctl reload nginx
 ```
 
-`nginx -t` should print `syntax is ok` / `test is successful` — confirm that before the reload takes effect.
+Confirmed: `nginx -t` → syntax ok, config test successful, reload applied cleanly.
 
 ---
 
@@ -312,6 +312,8 @@ In WebSupport admin panel:
 
 > ✅ No DDNS updater step is needed for this subdomain. `ddns-update.sh` on CT 108 only updates the root A record on IP change; this CNAME resolves through automatically.
 
+> ⚠️ **Note**: certbot's HTTP-01 challenge (Phase 7) needs this DNS record to already resolve publicly. If Phase 7 hasn't been attempted yet, do Phase 8 (DNS) *before* Phase 7 (SSL) — the guide lists them in this order for documentation clarity, but in practice DNS must propagate first or certbot will fail domain validation.
+
 ---
 
 ## Phase 9 — Authelia Protection (CT 102)
@@ -447,3 +449,4 @@ mkdir -p /opt/koillection/backups
 | `deprecation.INFO` API Platform log spam on startup | Harmless upstream framework warnings (duplicate `#[ApiResource]` shortName), not errors — ignore |
 | `nginx: command not found` when following Phase 6 | You're inside CT 114 (koillection), not CT 101 (reverse-proxy). Check the shell prompt — nginx work always happens on CT 101, never on the app container itself |
 | Wrong nginx vhost filename | Use the full domain as the filename (`collections.spendlik.sk`), matching every other vhost on CT 101 — not the short service name |
+| certbot fails domain validation | DNS (Phase 8) must resolve publicly before certbot's HTTP-01 challenge (Phase 7) will succeed — do DNS first if it hasn't propagated yet |