diff --git a/src/lib/instance/instance.go b/src/lib/instance/instance.go
index 6fb9282..e72f62f 100644
--- a/src/lib/instance/instance.go
+++ b/src/lib/instance/instance.go
@@ -90,12 +90,17 @@ func defaultIdentity() Identity {
 	if name := os.Getenv("DCNTRLIZED_INSTANCE_NAME"); name != "" {
 		return Identity{Name: name}
 	}
+	// The domain the instance announces as is its natural public name;
+	// federation attestation will reuse it.
+	if domain := os.Getenv("DCNTRLIZED_INSTANCE_DOMAIN"); domain != "" {
+		return Identity{Name: domain}
+	}
 	// Maestro normally runs containerized, where os.Hostname() is the bare
 	// container id — useless (and mildly leaking) as a public display name.
 	if host, err := osHostname(); err == nil && !looksLikeContainerID(host) {
 		return Identity{Name: host}
 	}
-	return Identity{Name: "maestro"}
+	return Identity{Name: "Maestro"}
 }
 
 // looksLikeContainerID reports whether s is a hex-only Docker-style container
diff --git a/src/lib/instance/instance_test.go b/src/lib/instance/instance_test.go
index feb1ae3..175aeb5 100644
--- a/src/lib/instance/instance_test.go
+++ b/src/lib/instance/instance_test.go
@@ -38,15 +38,25 @@ func TestDefaultIdentityFallbacks(t *testing.T) {
 	orig := osHostname
 	defer func() { osHostname = orig }()
 
-	t.Run("env wins", func(t *testing.T) {
+	t.Run("env wins over domain", func(t *testing.T) {
 		t.Setenv("DCNTRLIZED_INSTANCE_NAME", "edge-1")
+		t.Setenv("DCNTRLIZED_INSTANCE_DOMAIN", "maestro.dcntrlized.org")
 		if id := defaultIdentity(); id.Name != "edge-1" {
 			t.Fatalf("got %q", id.Name)
 		}
 	})
 
+	t.Run("announced domain used before hostname", func(t *testing.T) {
+		t.Setenv("DCNTRLIZED_INSTANCE_DOMAIN", "maestro.dcntrlized.org")
+		osHostname = func() (string, error) { return "archlinux", nil }
+		if id := defaultIdentity(); id.Name != "maestro.dcntrlized.org" {
+			t.Fatalf("got %q", id.Name)
+		}
+	})
+
 	t.Run("hostname used when human-readable", func(t *testing.T) {
 		os.Unsetenv("DCNTRLIZED_INSTANCE_NAME")
+		os.Unsetenv("DCNTRLIZED_INSTANCE_DOMAIN")
 		osHostname = func() (string, error) { return "archlinux", nil }
 		if id := defaultIdentity(); id.Name != "archlinux" {
 			t.Fatalf("got %q", id.Name)
@@ -55,9 +65,10 @@ func TestDefaultIdentityFallbacks(t *testing.T) {
 
 	t.Run("container-id hostname replaced", func(t *testing.T) {
 		os.Unsetenv("DCNTRLIZED_INSTANCE_NAME")
+		os.Unsetenv("DCNTRLIZED_INSTANCE_DOMAIN")
 		for _, host := range []string{"6079761d6e4d", "6079761d6e4dabcdef1234567890abcdef1234567890abcdef1234567890abcd"} {
 			osHostname = func() (string, error) { return host, nil }
-			if id := defaultIdentity(); id.Name != "maestro" {
+			if id := defaultIdentity(); id.Name != "Maestro" {
 				t.Fatalf("host %q: got %q", host, id.Name)
 			}
 		}