diff --git a/src/index.js b/src/index.js
index 1e615f4..a54ef8f 100644
--- a/src/index.js
+++ b/src/index.js
@@ -11,6 +11,11 @@ export { Mailbox } from "./do/mailbox.js";
 
 const app = new Hono();
 
+app.onError((err, c) => {
+  console.error("unhandled:", err.stack || err.message);
+  return c.json({ error: "server error" }, 500);
+});
+
 app.get("/api/health", (c) => c.json({ ok: true, service: "cipher" }));
 
 app.route("/api/auth", auth);
diff --git a/src/lib/auth.js b/src/lib/auth.js
index 82b4424..1ecc8fa 100644
--- a/src/lib/auth.js
+++ b/src/lib/auth.js
@@ -4,7 +4,8 @@
 
 import { b64, randomToken, now } from "./util.js";
 
-const PBKDF2_ITERS = 210000;
+// Cloudflare Workers caps PBKDF2 at 100k iterations (WebCrypto limit).
+const PBKDF2_ITERS = 100000;
 
 async function pbkdf2(password, saltBytes) {
   const enc = new TextEncoder();
diff --git a/wrangler.jsonc b/wrangler.jsonc
index f672427..62a967d 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -5,6 +5,9 @@
   "compatibility_date": "2025-07-01",
   "compatibility_flags": ["nodejs_compat"],
   "observability": { "enabled": true },
+  "routes": [
+    { "pattern": "cipher.theradicalparty.com", "custom_domain": true }
+  ],
   "assets": {
     "directory": "./public",
     "binding": "ASSETS",
@@ -14,7 +17,7 @@
     {
       "binding": "DB",
       "database_name": "cipher",
-      "database_id": "REPLACE_AFTER_CREATE",
+      "database_id": "f80ec87d-02ad-486d-b33a-50322f33c235",
       "migrations_dir": "migrations"
     }
   ],