diff --git a/apps/compliance-portal/.env.example b/apps/compliance-portal/.env.example
index 15ae6d2b4..8f0decaf1 100644
--- a/apps/compliance-portal/.env.example
+++ b/apps/compliance-portal/.env.example
@@ -1,5 +1,9 @@
-# Browser hits the Vite origin; /graphql is proxied (see vite.config.ts).
-VITE_API_URL=http://localhost:5174
+# GraphQL API origin. Default matches other apps (probod on :8080). For local
+# Vite development, set this to http://localhost:5174 so the browser hits the
+# Vite origin and /graphql is proxied (see vite.config.ts).
+VITE_API_URL=http://localhost:8080
 
-# Compliance-portal HTTPS origin (<slug> is the compliance portal slug).
-COMPLIANCE_PORTAL_PROXY_TARGET=https://<slug>.probopage.localhost
+# Vite /graphql proxy target (compliance-portal HTTPS origin; <slug> is the
+# portal slug). Required for local Vite development — uncomment and set the
+# slug when running the app locally (see vite.config.ts).
+# COMPLIANCE_PORTAL_PROXY_TARGET=https://<slug>.probopage.localhost
diff --git a/pkg/server/api/complianceportal/sni_middleware.go b/pkg/server/api/complianceportal/sni_middleware.go
index 66f52929a..a37241920 100644
--- a/pkg/server/api/complianceportal/sni_middleware.go
+++ b/pkg/server/api/complianceportal/sni_middleware.go
@@ -30,6 +30,7 @@ import (
 	"github.com/99designs/gqlgen/graphql"
 	"github.com/vektah/gqlparser/v2/gqlerror"
 	"go.gearno.de/kit/httpserver"
+	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
@@ -51,6 +52,13 @@ func NewSNIMiddleware(visitorSvc *visitor.Service) func(next http.Handler) http.
 					return
 				}
 
+				httpserver.LoggerFromContext(ctx).ErrorCtx(
+					ctx,
+					"cannot get compliance portal by domain name",
+					log.Error(err),
+					log.String("server_name", r.TLS.ServerName),
+				)
+
 				httpserver.RenderJSON(
 					w,
 					http.StatusInternalServerError,
@@ -70,6 +78,13 @@ func NewSNIMiddleware(visitorSvc *visitor.Service) func(next http.Handler) http.
 			if !strings.HasPrefix(r.URL.Path, "/.well-known/") {
 				canonicalHost, err := visitorSvc.GetPortalEffectiveCanonicalHost(ctx, compliancePage.ID)
 				if err != nil {
+					httpserver.LoggerFromContext(ctx).ErrorCtx(
+						ctx,
+						"cannot get compliance portal canonical host",
+						log.Error(err),
+						log.String("compliance_portal_id", compliancePage.ID.String()),
+					)
+
 					httpserver.RenderJSON(
 						w,
 						http.StatusInternalServerError,