diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml
index fc8c1e5..2a7db8d 100644
--- a/config/ssh_secret_backend_role/sshca/signhost.yaml
+++ b/config/ssh_secret_backend_role/sshca/signhost.yaml
@@ -3,6 +3,8 @@ algorithm_signer: rsa-sha2-256
 ttl: 315360000  # 87600 * 3600
 allow_host_certificates: true
 allow_user_certificates: false
-allowed_domains: "unkin.net,main.unkin.net,consul"
+# "*" must be the sole entry: OpenBao only treats allowed_domains as unrestricted
+# when the whole string is "*", and otherwise matches entries exactly or by suffix.
+allowed_domains: "*"
 allow_subdomains: true
 allow_bare_domains: false