diff --git a/README.md b/README.md
index 1f63e5c..f381489 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@ sudo install -m 0755 scripts/check-cert-expiry.sh /opt/scripts/check-cert-expiry
 ```bash
 CERT_DIR=/etc/letsencrypt/live
 EXPIRY_DAYS=14
-NTFY_URL=https://ntfy.silverwal.com/certbot
+NTFY_URL=http://127.0.0.1:2586/certbot
 ALERT_ON_NO_CERTS=true
 ```
 
@@ -64,6 +64,13 @@ ntfy is a good default for this server because it is already self-hosted, simple
 to call from shell scripts, and supports useful alert metadata such as title,
 priority, and tags.
 
+Alerts go to ntfy over `http://127.0.0.1:2586` rather than the public
+`https://ntfy.silverwal.com` URL. The public URL is served by the same nginx
+whose certificates this script watches, so an expired or broken certificate on
+this host would fail curl's TLS verification and silently drop the very alert
+that reports it. The loopback address removes DNS, nginx, and TLS from the
+alerting path.
+
 For jobs where silence is also a failure, pair ntfy with a dead man's switch such
 as Healthchecks. ntfy tells you what the script found; Healthchecks tells you when
 the script did not run at all.
diff --git a/scripts/check-cert-expiry.sh b/scripts/check-cert-expiry.sh
index c42a62d..cb0751a 100644
--- a/scripts/check-cert-expiry.sh
+++ b/scripts/check-cert-expiry.sh
@@ -4,7 +4,7 @@ set -uo pipefail
 
 CERT_DIR="${CERT_DIR:-/etc/letsencrypt/live}"
 EXPIRY_DAYS="${EXPIRY_DAYS:-14}"
-NTFY_URL="${NTFY_URL:-https://ntfy.silverwal.com/certbot}"
+NTFY_URL="${NTFY_URL:-http://127.0.0.1:2586/certbot}"
 NTFY_TITLE="${NTFY_TITLE:-SSL certificate warning}"
 NTFY_PRIORITY="${NTFY_PRIORITY:-high}"
 NTFY_TAGS="${NTFY_TAGS:-warning,lock}"