diff --git a/fleet/PROTOCOL.md b/fleet/PROTOCOL.md
index 03cdbad24..ef38a6bde 100644
--- a/fleet/PROTOCOL.md
+++ b/fleet/PROTOCOL.md
@@ -388,7 +388,11 @@ tiles rounded up, whichever is smaller), and a claim when no tile can be lent.
   and `failures` carry it.
 - `aggregates` lists the regions an aggregator serves (see Aggregator): one per GPU host
   that has placed tiles, with the tiles inside it, and the EC2 half when the coordinator
-  runs its aggregator. `frame_url` is null until the host's aggregator is serving.
+  runs its aggregator. `frame_url` is null until the host's aggregator is serving. With
+  the coordinator's DNS (`--dns-token-secret`) a host aggregator's `frame_url` and
+  `frame_url_v4` are its published names (`wss://agg-<host>-<token>.<zone>/frames`,
+  `wss://agg-<host>-<token>-v4.<zone>:<port>/frames`), and both stay null for an aggregator
+  that serves no browser (no `--aggregate-tls-port`).
 - `actions` holds the latest 50 intents, committed and refused, oldest first: the
   `viewer` that sent it, the intent `id`, its `args` (a refused word's are `{}`, so its
   text appears nowhere), and the outcome.
@@ -410,7 +414,8 @@ relaunching (its region would be black; claimed GPUs and dark tiles do not count
 fcvm fleet coord --listen <addr:port> [--agent-cmd '<command>']... [--state-file <path>]
                  [--text-check bedrock --text-check-model <id> --text-check-region <region> | --text-check none]
                  [--max-tiles 100] [--ec2 none|fake] [--allowed-origin <scheme://host[:port]>]...
-                 [--ec2-aggregate-listen <addr:port> --ec2-aggregate-url <ws url>] [--aggregate-arg <arg>]...
+                 [--ec2-aggregate-listen <addr:port> (--ec2-aggregate-url <ws url> | --ec2-aggregate-tls
+                  [--ec2-aggregate-tls-dir /run/fcvm-fleet/tls])] [--aggregate-arg <arg>]...
                  [--race-every <secs>] [--restart-cooldown 60] [--camera-seed 1] [--max-borrowed <n>]
                  [--trust-cf-connecting-ip] [--turnstile-secret <secret> --turnstile-site-key <key>]
                  [--admin-listen <addr:port>] [--ffmpeg ffmpeg]
@@ -470,8 +475,12 @@ fcvm fleet coord --listen <addr:port> [--agent-cmd '<command>']... [--state-file
   asked for before it exists and never changes address, so no resolver holds a negative or
   stale answer for it. A launch's records stay until its slot has a newer published launch
   or leaves the fleet; names of the fleet's shape (`slot-<n>`, `ec2-<n>`, with or without a
-  token, with or without `-v4`) that nothing references are deleted, at start too; every
-  other name in the zone is left alone.
+  token, `agg-<host>-<token>`, each with or without `-v4`) that nothing references are
+  deleted, at start too; every other name in the zone is left alone. A host aggregator
+  that reports public addresses is named the same way under `agg-<host>-<token>` (a host
+  name of lowercase letters, digits and inner hyphens, at most 40 characters): AAAA its own
+  IPv6 address, A the host's IPv4 address, with its port in `frame_url_v4`. Its names last
+  while it reports the same addresses.
 - `--dns-subzone` makes the coordinator the authoritative DNS server of a subzone of
   `--dns-zone` (the parent delegates it with NS records naming `--dns-subzone-ns`, and no DS
   record) and names launches there instead: `<label>.<subzone>` AAAA and
@@ -487,6 +496,18 @@ fcvm fleet coord --listen <addr:port> [--agent-cmd '<command>']... [--state-file
   dropped. With `--dns-token-secret` it deletes, once at start, the launch names earlier
   written to the parent zone.
 - `--tls-secret` keeps the wildcard certificate renewed (see "Certificate").
+- `--ec2-aggregate-tls` (with `--ec2-aggregate-listen`, `--tls-secret` and
+  `--dns-token-secret`) serves the EC2 half's aggregator to browsers with TLS on port 443
+  of the coordinator task's own addresses, read at start on ECS: the global IPv6 address
+  from the task metadata (`ECS_CONTAINER_METADATA_URI_V4`) and the public IPv4 address of
+  the task's network interface (EC2 `DescribeNetworkInterfaces` by its private address, in
+  `AWS_REGION`, with the task role). It writes the certificate (from `--tls-secret`) as
+  `tls.json` into `--ec2-aggregate-tls-dir` for the aggregator and reads the secret again
+  hourly, and names the addresses `agg-ec2-<token>` (AAAA and `-v4` A, both on 443) like a
+  host aggregator. A non-root process binds 443 only where the task lowers
+  `net.ipv4.ip_unprivileged_port_start` (it covers IPv6 too). With published names the
+  EC2 aggregate's `frame_url`/`frame_url_v4` are those names, else null;
+  `--ec2-aggregate-url` is used only without the DNS writer.
 
 ### Certificate
 
@@ -828,7 +849,8 @@ round that counts it.
 fcvm fleet agent (--stdio | --dial <wss url> [--access-secret <secret>]) --image <renderer image> --base-port <port>
                  [--host <name>] [--publish-ip <ip>] [--frame-host <name or ip>]
                  [--gpus <sbdf>=<name>,...] [--fcvm <path>] [--fcvm-arg <arg>]...
-                 [--spot-notice-url <url>] [--aggregate-port <port> [--aggregate-arg <arg>]...]
+                 [--spot-notice-url <url>] [--aggregate-port <port> [--aggregate-arg <arg>]...
+                  [--aggregate-tls-port <port>]]
                  [--scrub] [--store-ready-file <path>] [--host-from-imds] [--secret-region <region>]
                  [--tls-secret <secret> [--tls-dir /run/fcvm-fleet/tls]]
                  [--ipv6-prefix <prefix/len> | --ipv6-prefix-from-imds] [--frame-zone <zone>]
@@ -883,6 +905,16 @@ every assignment or scene change, and reports it once it answers:
 {"type": "aggregate", "frame_url": "ws://<frame host>:<port>/frames"}
 ```
 
+`--aggregate-tls-port <port>` (with `--tls-secret`) also serves the stream to browsers with
+TLS (the aggregator's `--tls-listen`, the renderers' certificate file): on `<publish ip>:<port>`,
+and with an IPv6 prefix on port 443 of `<prefix>::1`, the host's side of the prefix (fcvm
+never gives it to a VM), which the agent puts on the host's default IPv6 interface
+(`ip -6 addr replace <addr>/128 dev <iface> nodad`) before it starts. The message then
+carries what the coordinator names (`agg-<host>-<token>`, see `--dns-token-secret`):
+`ipv6` (port 443), and with `--public-ipv4-from-imds` the host's `ipv4` and the port as
+`v4_port`. The aggregator's `--listen` stays on `<publish ip>:<aggregate port>`, which the
+host's security group does not admit.
+
 ## Aggregator
 
 `fcvm fleet aggregate` joins one region's tiles into one stream: the agent runs one per
diff --git a/fleet/coord/Containerfile b/fleet/coord/Containerfile
index 524af1a1a..60eaed70b 100644
--- a/fleet/coord/Containerfile
+++ b/fleet/coord/Containerfile
@@ -7,6 +7,10 @@ FROM docker.io/library/ubuntu:24.04
 RUN apt-get update -q && apt-get install -y -q --no-install-recommends ffmpeg ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 COPY fcvm /usr/local/bin/fcvm
+# --ec2-aggregate-tls writes the certificate file under /run/fcvm-fleet (the task mounts a
+# volume there; the root file system is read-only). The directory is the coordinator's own,
+# so a volume that takes the image's ownership is writable by it.
+RUN mkdir -p /run/fcvm-fleet && chown 65534:65534 /run/fcvm-fleet
 USER 65534:65534
 EXPOSE 8080
 ENTRYPOINT ["/usr/local/bin/fcvm", "fleet", "coord"]
diff --git a/fleet/core/src/apply.rs b/fleet/core/src/apply.rs
index f2f7bace9..a7085f118 100644
--- a/fleet/core/src/apply.rs
+++ b/fleet/core/src/apply.rs
@@ -196,7 +196,33 @@ fn apply_inner(state: &mut State, event: &Event) -> Option<Receipt> {
             None
         }
         Event::Published { slot, names, .. } => {
+            let c = &state.config;
+            if slot == crate::state::EC2_AGGREGATE_ID {
+                if names.names(
+                    c.ec2_aggregate_ipv6.as_deref(),
+                    c.ec2_aggregate_ipv4.as_deref(),
+                    None,
+                ) {
+                    state.fleet.ec2_aggregate_published = Some(names.clone());
+                }
+                return None;
+            }
             let f = &mut state.fleet;
+            // A host aggregator's names, for the addresses it reports now.
+            if let Some(h) = f
+                .hosts
+                .values_mut()
+                .find(|h| crate::state::aggregate_id(&h.name).as_deref() == Some(slot.as_str()))
+            {
+                if names.names(
+                    h.aggregate_ipv6.as_deref(),
+                    h.aggregate_ipv4.as_deref(),
+                    h.aggregate_v4_port,
+                ) {
+                    h.aggregate_published = Some(names.clone());
+                }
+                return None;
+            }
             if let Some(s) = f
                 .slots
                 .values_mut()
@@ -299,9 +325,17 @@ fn apply_inner(state: &mut State, event: &Event) -> Option<Receipt> {
                         at,
                     );
                 }
-                AgentMsg::Aggregate { frame_url } => {
+                AgentMsg::Aggregate {
+                    frame_url,
+                    ipv6,
+                    ipv4,
+                    v4_port,
+                } => {
                     if let Some(h) = state.fleet.hosts.get_mut(host) {
                         h.aggregate_url = Some(frame_url.clone());
+                        h.aggregate_ipv6 = ipv6.clone();
+                        h.aggregate_ipv4 = ipv4.clone();
+                        h.aggregate_v4_port = *v4_port;
                     }
                 }
                 AgentMsg::Scrub { ok, .. } => {
@@ -1026,6 +1060,10 @@ fn hello(f: &mut Fleet, host: &str, arch: &str, gpus: &[Gpu], capacity: usize, a
             joined_at: at,
             region: None,
             aggregate_url: None,
+            aggregate_ipv6: None,
+            aggregate_ipv4: None,
+            aggregate_v4_port: None,
+            aggregate_published: None,
         },
     );
     f.reclaimed.remove(host);
diff --git a/fleet/core/src/protocol.rs b/fleet/core/src/protocol.rs
index b2b5abf2f..a5b443b83 100644
--- a/fleet/core/src/protocol.rs
+++ b/fleet/core/src/protocol.rs
@@ -205,9 +205,17 @@ pub enum AgentMsg {
     Draining {
         reason: String,
     },
-    /// The host's aggregator is serving the host's region at this frame WebSocket.
+    /// The host's aggregator is serving the host's region at this frame WebSocket, and,
+    /// when it serves browsers with TLS, at these public addresses: its own IPv6 address
+    /// (port 443) and the host's IPv4 address on `v4_port`. The coordinator names them.
     Aggregate {
         frame_url: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        ipv6: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        ipv4: Option<String>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        v4_port: Option<u16>,
     },
     /// A GPU scrub finished (`ok`), or failed with `error`.
     Scrub {
diff --git a/fleet/core/src/state.rs b/fleet/core/src/state.rs
index 7091097d5..2a3f2d419 100644
--- a/fleet/core/src/state.rs
+++ b/fleet/core/src/state.rs
@@ -27,6 +27,12 @@ pub struct Config {
     /// The EC2 half's aggregator frame WebSocket, when the coordinator runs one.
     #[serde(default)]
     pub ec2_aggregate_url: Option<String>,
+    /// The EC2 half's aggregator's public addresses when it serves browsers with TLS (on
+    /// 443 in both families): the coordinator task's own. Named `agg-ec2-<token>`.
+    #[serde(default)]
+    pub ec2_aggregate_ipv6: Option<String>,
+    #[serde(default)]
+    pub ec2_aggregate_ipv4: Option<String>,
     /// The owner's race cadence: a relaunch of every tile this often. `None`: no schedule.
     pub race_interval_secs: Option<u64>,
     /// After any race, `restart_now` is refused for this long, for everyone.
@@ -131,6 +137,8 @@ impl Default for Config {
             light_interval_ms: 1_000,
             relaunch_interval_ms: 2_000,
             ec2_aggregate_url: None,
+            ec2_aggregate_ipv6: None,
+            ec2_aggregate_ipv4: None,
             race_interval_secs: None,
             restart_cooldown_secs: 60,
             camera_seed: 1,
@@ -165,6 +173,18 @@ pub struct Host {
     /// The host aggregator's frame WebSocket, once the agent reports it.
     #[serde(default)]
     pub aggregate_url: Option<String>,
+    /// The aggregator's public addresses, as last reported (`AgentMsg::Aggregate`), and the
+    /// port of its IPv4 path.
+    #[serde(default)]
+    pub aggregate_ipv6: Option<String>,
+    #[serde(default)]
+    pub aggregate_ipv4: Option<String>,
+    #[serde(default)]
+    pub aggregate_v4_port: Option<u16>,
+    /// The aggregator's published DNS names (with `Config::names_published`), under the
+    /// label `agg-<host>-<token>` (see [`aggregate_id`]).
+    #[serde(default)]
+    pub aggregate_published: Option<Published>,
 }
 
 /// What an agent (or the EC2 driver) last said about one slot.
@@ -511,6 +531,9 @@ pub struct Fleet {
     pub budget: crate::budget::Budget,
     /// Coordinator components that are degraded: reason and since when.
     pub degraded: BTreeMap<String, (String, u64)>,
+    /// The EC2 half's aggregator's published DNS names (`EC2_AGGREGATE_ID`).
+    #[serde(default)]
+    pub ec2_aggregate_published: Option<Published>,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -560,6 +583,7 @@ impl State {
                 warming: Default::default(),
                 power: Power::default(),
                 budget: Default::default(),
+                ec2_aggregate_published: None,
             },
             config,
             receipts: BTreeMap::new(),
@@ -583,6 +607,8 @@ impl State {
         f.viewers.clear();
         f.hidden.clear();
         f.degraded.clear();
+        // The EC2 aggregator's names were for the previous coordinator's addresses.
+        f.ec2_aggregate_published = None;
         // A race interrupted by the restart cannot finish (its slots come back at
         // generation 1), on either half.
         let finished = |h: &HalfRace| h.done_at.is_some() || h.tiles.is_empty();
@@ -636,6 +662,41 @@ pub fn ec2_name(n: u32) -> String {
     format!("ec2-{n}")
 }
 
+/// The id a host's aggregator is named under in DNS, `agg-<host>`, when the host's name can
+/// be part of a DNS label: lowercase letters, digits and inner hyphens, at most 40
+/// characters (an EC2 instance id is 19), and not `ec2`, kept for the EC2 half's aggregator.
+pub fn aggregate_id(host: &str) -> Option<String> {
+    let ok = !host.is_empty()
+        && host.len() <= 40
+        && host != "ec2"
+        && !host.starts_with('-')
+        && !host.ends_with('-')
+        && host
+            .bytes()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-');
+    ok.then(|| format!("agg-{host}"))
+}
+
+/// The id the EC2 half's aggregator is named under in DNS.
+pub const EC2_AGGREGATE_ID: &str = "agg-ec2";
+
+/// An address in its canonical text (`2001:db8::2` for `2001:0db8::2`); text that is not an
+/// address is kept as it is.
+pub fn canonical_ip(a: &str) -> String {
+    a.parse::<std::net::IpAddr>()
+        .map(|ip| ip.to_string())
+        .unwrap_or_else(|_| a.to_string())
+}
+
+impl Published {
+    /// Whether these names are for exactly these addresses and IPv4 port.
+    pub fn names(&self, ipv6: Option<&str>, ipv4: Option<&str>, v4_port: Option<u16>) -> bool {
+        self.ipv6 == ipv6.map(canonical_ip)
+            && self.ipv4 == ipv4.map(canonical_ip)
+            && self.v4_port == v4_port
+    }
+}
+
 /// Parse `slot-<n>` back to its number.
 pub fn slot_number(id: &str) -> Option<u32> {
     id.strip_prefix("slot-")?.parse().ok()
@@ -649,6 +710,27 @@ pub fn ec2_number(id: &str) -> Option<u32> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_host_aggregator_is_named_only_when_its_host_name_fits_a_label() {
+        assert_eq!(
+            aggregate_id("i-0123456789abcdef0").as_deref(),
+            Some("agg-i-0123456789abcdef0")
+        );
+        assert_eq!(aggregate_id("gpu-a").as_deref(), Some("agg-gpu-a"));
+        for bad in [
+            "",
+            "ec2",
+            "-gpu",
+            "gpu-",
+            "GPU-A",
+            "gpu.example.com",
+            "gpu_a",
+            &"a".repeat(41),
+        ] {
+            assert_eq!(aggregate_id(bad), None, "{bad:?}");
+        }
+    }
+
     #[test]
     fn a_layout_leaves_every_renderer_half_a_second_after_its_post() {
         for t in [0.0, 0.004, 0.01, 0.034, 12.345, 861.999, 3600.5] {
diff --git a/fleet/core/src/view.rs b/fleet/core/src/view.rs
index d06d3d17b..9e30b8df7 100644
--- a/fleet/core/src/view.rs
+++ b/fleet/core/src/view.rs
@@ -272,9 +272,11 @@ pub struct AggregateView {
     pub half: Half,
     pub host: Option<String>,
     pub rect: Rect,
-    /// The aggregator's frame WebSocket; null until it is serving. `frame_url_v4` is its
-    /// IPv4 sibling (every `*_url` has one): null for now, since an aggregator serves plain
-    /// WebSocket on the GPU host or in the coordinator, not under a published name.
+    /// The aggregator's frame WebSocket over IPv6 and over IPv4; null until it is serving.
+    /// With published names (the fleet's DNS), those of the addresses it serves now, once
+    /// published: `wss://agg-<host>-<token>.<zone>/frames` and
+    /// `wss://agg-<host>-<token>-v4.<zone>:<port>/frames`. Otherwise the URL it was reported
+    /// at, with no IPv4 one. The EC2 half's are `agg-ec2-<token>`, both on 443.
     pub frame_url: Option<String>,
     pub frame_url_v4: Option<String>,
     /// The tiles inside the region, by tile id.
@@ -484,26 +486,31 @@ pub fn view(state: &State) -> View {
                 .filter_map(|s| Some((s.position?, tile_id(Half::Fcvm, s)?)))
                 .collect();
             placed.sort();
+            let (frame_url, frame_url_v4) = host_aggregate_urls(state, h);
             Some(AggregateView {
                 id: format!("agg:{}", h.name),
                 half: Half::Fcvm,
                 host: Some(h.name.clone()),
                 rect,
-                frame_url: h.aggregate_url.clone(),
-                frame_url_v4: None,
+                frame_url,
+                frame_url_v4,
                 tiles: placed.into_iter().map(|(_, id)| id).collect(),
             })
         })
         .collect();
     aggregates.sort_by(|a, b| a.rect.y.total_cmp(&b.rect.y));
-    if let (Some(url), Some(rect)) = (&c.ec2_aggregate_url, f.layout.ec2) {
+    let ec2_aggregator = c.ec2_aggregate_url.is_some()
+        || c.ec2_aggregate_ipv6.is_some()
+        || c.ec2_aggregate_ipv4.is_some();
+    if let (true, Some(rect)) = (ec2_aggregator, f.layout.ec2) {
+        let (frame_url, frame_url_v4) = ec2_aggregate_urls(state);
         aggregates.push(AggregateView {
             id: "agg:ec2".into(),
             half: Half::Ec2,
             host: None,
             rect,
-            frame_url: Some(url.clone()),
-            frame_url_v4: None,
+            frame_url,
+            frame_url_v4,
             tiles: (1..=f.ec2_n).map(|k| format!("ec2:{k}")).collect(),
         });
     }
@@ -835,28 +842,61 @@ pub fn shared_scene(state: &State) -> SharedScene {
     SharedScene::new(&state.fleet.scene, state.config.image_aspect)
 }
 
+/// A host aggregator's frame URLs (IPv6, IPv4). With published names, those of the
+/// addresses it reports now, once published; otherwise the URL it reported, with no IPv4 one.
+pub fn host_aggregate_urls(state: &State, h: &Host) -> (Option<String>, Option<String>) {
+    if !state.config.names_published {
+        return (h.aggregate_url.clone(), None);
+    }
+    match &h.aggregate_published {
+        Some(p)
+            if p.names(
+                h.aggregate_ipv6.as_deref(),
+                h.aggregate_ipv4.as_deref(),
+                h.aggregate_v4_port,
+            ) =>
+        {
+            (p.frame_url.clone(), p.frame_url_v4.clone())
+        }
+        _ => (None, None),
+    }
+}
+
+/// The EC2 half's aggregator's frame URLs (IPv6, IPv4), as for a host aggregator: with
+/// published names, those of the coordinator's addresses once published; otherwise
+/// `--ec2-aggregate-url`, with no IPv4 one.
+pub fn ec2_aggregate_urls(state: &State) -> (Option<String>, Option<String>) {
+    let c = &state.config;
+    if !c.names_published {
+        return (c.ec2_aggregate_url.clone(), None);
+    }
+    match &state.fleet.ec2_aggregate_published {
+        Some(p)
+            if p.names(
+                c.ec2_aggregate_ipv6.as_deref(),
+                c.ec2_aggregate_ipv4.as_deref(),
+                None,
+            ) =>
+        {
+            (p.frame_url.clone(), p.frame_url_v4.clone())
+        }
+        _ => (None, None),
+    }
+}
+
 /// A tile's frame URLs (IPv6, IPv4). With published names, those of the launch the slot is
 /// on, once published; otherwise the URL its agent reported, with no IPv4 one.
 pub fn frame_urls(state: &State, s: &Slot) -> (Option<String>, Option<String>) {
     if !state.config.names_published {
         return (s.observed.frame_url.clone(), None);
     }
-    let canonical = |a: &Option<String>| {
-        a.as_ref().map(|a| {
-            a.parse::<std::net::IpAddr>()
-                .map(|ip| ip.to_string())
-                .unwrap_or_else(|_| a.clone())
-        })
-    };
     let o = &s.observed;
     match &s.published {
         // The names of exactly what the slot runs now: a new address or port at the same
         // generation waits for its own names.
         Some(p)
             if p.generation == o.generation
-                && p.ipv6 == canonical(&o.ipv6)
-                && p.ipv4 == canonical(&o.ipv4)
-                && p.v4_port == o.v4_port =>
+                && p.names(o.ipv6.as_deref(), o.ipv4.as_deref(), o.v4_port) =>
         {
             (p.frame_url.clone(), p.frame_url_v4.clone())
         }
diff --git a/src/cli/args.rs b/src/cli/args.rs
index 33367cce7..83fcae151 100644
--- a/src/cli/args.rs
+++ b/src/cli/args.rs
@@ -194,14 +194,27 @@ pub struct FleetCoordArgs {
     #[arg(long = "allowed-origin")]
     pub allowed_origins: Vec<String>,
 
-    /// Run the EC2 half's aggregator on this address
-    #[arg(long, requires = "ec2_aggregate_url")]
+    /// Run the EC2 half's aggregator on this address (its layout, stats and a stream for
+    /// the coordinator); browsers reach it at --ec2-aggregate-url, or with
+    /// --ec2-aggregate-tls at its published names
+    #[arg(long)]
     pub ec2_aggregate_listen: Option<String>,
 
     /// The EC2 half's aggregator frame WebSocket as browsers reach it
     #[arg(long, requires = "ec2_aggregate_listen")]
     pub ec2_aggregate_url: Option<String>,
 
+    /// Serve the EC2 half's aggregator to browsers with TLS (the --tls-secret certificate)
+    /// on port 443 of the coordinator task's own addresses, read on ECS (the task metadata
+    /// for IPv6, EC2 DescribeNetworkInterfaces for the public IPv4 address), and name them
+    /// `agg-ec2-<token>` (needs --dns-token-secret)
+    #[arg(long, requires_all = ["ec2_aggregate_listen", "tls_secret", "dns_token_secret"])]
+    pub ec2_aggregate_tls: bool,
+
+    /// Where the coordinator keeps the certificate file of --ec2-aggregate-tls
+    #[arg(long, default_value = "/run/fcvm-fleet/tls")]
+    pub ec2_aggregate_tls_dir: std::path::PathBuf,
+
     /// Extra argument for the EC2 half's aggregator. Repeatable.
     #[arg(long = "aggregate-arg", allow_hyphen_values = true)]
     pub aggregate_args: Vec<String>,
@@ -488,6 +501,14 @@ pub struct FleetAgentArgs {
     #[arg(long = "aggregate-arg", allow_hyphen_values = true)]
     pub aggregate_args: Vec<String>,
 
+    /// Serve the aggregator's stream to browsers with TLS (the --tls-secret certificate):
+    /// on this port of --publish-ip, reported with the host's public IPv4 address
+    /// (--public-ipv4-from-imds), and with an IPv6 prefix on port 443 of `<prefix>::1`,
+    /// which the agent adds to the host's default IPv6 interface. The coordinator names
+    /// both (`agg-<host>-<token>`).
+    #[arg(long, requires_all = ["aggregate_port", "tls_secret"])]
+    pub aggregate_tls_port: Option<u16>,
+
     /// A file the host's boot writes once its store is mounted; its modification time is
     /// reported in the hello (the wake's `store_ready` phase)
     #[arg(long)]
diff --git a/src/fleet/agent/addr.rs b/src/fleet/agent/addr.rs
index 0babcc922..9c4f30790 100644
--- a/src/fleet/agent/addr.rs
+++ b/src/fleet/agent/addr.rs
@@ -33,6 +33,12 @@ impl Prefix {
         })
     }
 
+    /// The host aggregator's address, `<prefix>::1`: the host's side of the prefix, which
+    /// fcvm never gives a VM.
+    pub fn aggregator_address(&self) -> Ipv6Addr {
+        Ipv6Addr::from(self.base | 1)
+    }
+
     /// The address of the slot on the GPU at `index` in the host's inventory.
     pub fn slot_address(&self, index: usize) -> Result<Ipv6Addr> {
         let host_bits = 128 - u32::from(self.len);
@@ -63,6 +69,36 @@ pub async fn from_imds() -> Result<Prefix> {
     Prefix::parse(first)
 }
 
+/// Put `addr` on the host's default IPv6 interface (the one fcvm's routed mode answers for
+/// its VMs on), so the aggregator can listen there. Idempotent: an agent that restarts finds
+/// it in place.
+pub async fn add_host_address(addr: Ipv6Addr) -> Result<()> {
+    let iface = crate::network::routed::detect_default_ipv6_interface()
+        .await
+        .context("the host has no default IPv6 route, so no interface to put the aggregator's address on")?;
+    let out = tokio::process::Command::new("ip")
+        .args([
+            "-6",
+            "addr",
+            "replace",
+            &format!("{addr}/128"),
+            "dev",
+            &iface,
+            "nodad",
+        ])
+        .output()
+        .await
+        .context("running ip")?;
+    if !out.status.success() {
+        bail!(
+            "ip -6 addr replace {addr}/128 dev {iface}: {}",
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!(%addr, %iface, "aggregator address on the host");
+    Ok(())
+}
+
 /// fcvm's routed mode needs root, so an agent given a prefix must run as root; refusing at
 /// start beats every VM failing (and being retried) with the same configuration error.
 pub fn check_routed_user(routed: bool, root: bool) -> Result<()> {
@@ -104,6 +140,7 @@ mod tests {
         assert_eq!(p.to_string(), "2001:db8:1:2:3::/80");
         assert_eq!(p.slot_address(0).unwrap().to_string(), "2001:db8:1:2:3::2");
         assert_eq!(p.slot_address(7).unwrap().to_string(), "2001:db8:1:2:3::9");
+        assert_eq!(p.aggregator_address().to_string(), "2001:db8:1:2:3::1");
         let small = Prefix::parse("2001:db8::/124").unwrap();
         assert_eq!(small.slot_address(13).unwrap().to_string(), "2001:db8::f");
         assert!(small.slot_address(14).is_err(), "past the prefix");
diff --git a/src/fleet/agent/mod.rs b/src/fleet/agent/mod.rs
index 3e73324b5..71f3c03aa 100644
--- a/src/fleet/agent/mod.rs
+++ b/src/fleet/agent/mod.rs
@@ -32,14 +32,78 @@ pub struct Agent {
     pub spot_notice_url: Option<String>,
     /// How often the spot notice URL is polled.
     pub spot_poll: Duration,
-    /// Run an aggregator for this host's band on this port, with this command
-    /// (`fcvm fleet aggregate ...`; `--listen` is added).
-    pub aggregate: Option<(u16, Vec<String>)>,
+    /// Run an aggregator for this host's band.
+    pub aggregate: Option<AggregateCfg>,
     /// A file the host's boot writes once its store is mounted; its modification time is
     /// reported in the hello.
     pub store_ready_file: Option<std::path::PathBuf>,
 }
 
+/// The host's aggregator.
+#[derive(Debug, Clone)]
+pub struct AggregateCfg {
+    /// Its private listener (`--listen <publish ip>:<port>`): the layout, the stats, and the
+    /// stream for host-local readers.
+    pub port: u16,
+    /// The command (`fcvm fleet aggregate ...`; `--listen` and the TLS arguments are added).
+    pub argv: Vec<String>,
+    /// Serving browsers with TLS.
+    pub public: Option<AggregatePublic>,
+}
+
+/// Where the aggregator serves browsers, and what the agent reports of it.
+#[derive(Debug, Clone)]
+pub struct AggregatePublic {
+    /// The certificate file (the renderers' `tls.json`).
+    pub tls_file: std::path::PathBuf,
+    /// The IPv4 port, on the publish address.
+    pub v4_port: u16,
+    /// The host's public IPv4 address, reported with `v4_port`.
+    pub ipv4: Option<String>,
+    /// Its own IPv6 address, served on 443 (the host must hold it).
+    pub ipv6: Option<std::net::Ipv6Addr>,
+}
+
+impl AggregateCfg {
+    /// The aggregator's command with its listeners.
+    pub fn command(&self, publish_ip: &str) -> (Vec<String>, String) {
+        let listen = format!("{}:{}", bracket(publish_ip), self.port);
+        let mut argv = self.argv.clone();
+        if let Some(p) = &self.public {
+            argv.push("--tls-file".into());
+            argv.push(p.tls_file.to_string_lossy().into_owned());
+            argv.push("--tls-listen".into());
+            argv.push(format!("{}:{}", bracket(publish_ip), p.v4_port));
+            if let Some(a) = p.ipv6 {
+                argv.push("--tls-listen".into());
+                argv.push(format!("[{a}]:{}", tls::PORT));
+            }
+        }
+        (argv, listen)
+    }
+
+    /// The message that reports it serving.
+    pub fn report(&self, frame_url: String) -> AgentMsg {
+        let p = self.public.as_ref();
+        let ipv4 = p.and_then(|p| p.ipv4.clone());
+        AgentMsg::Aggregate {
+            frame_url,
+            ipv6: p.and_then(|p| p.ipv6).map(|a| a.to_string()),
+            v4_port: ipv4.as_ref().and(p.map(|p| p.v4_port)),
+            ipv4,
+        }
+    }
+}
+
+/// An IPv6 literal in brackets, for `<address>:<port>`.
+fn bracket(ip: &str) -> String {
+    if ip.contains(':') && !ip.starts_with('[') {
+        format!("[{ip}]")
+    } else {
+        ip.to_string()
+    }
+}
+
 /// The modification time of `path` in Unix milliseconds, if it exists.
 fn mtime_ms(path: &std::path::Path) -> Option<u64> {
     let t = std::fs::metadata(path).ok()?.modified().ok()?;
@@ -107,10 +171,10 @@ pub async fn run(args: FleetAgentArgs) -> Result<()> {
             image: args.image,
             extra_args: fcvm_args,
             frame_host: args.frame_host.unwrap_or_else(|| args.publish_ip.clone()),
-            ipv6_prefix,
+            ipv6_prefix: ipv6_prefix.clone(),
             frame_zone: args.frame_zone,
             tls_publish_base: args.tls_publish_base,
-            public_ipv4,
+            public_ipv4: public_ipv4.clone(),
             publish_ip: args.publish_ip,
             sysfs_root: args.sysfs_root,
             start_timeout: Duration::from_secs(args.start_timeout_secs),
@@ -127,7 +191,7 @@ pub async fn run(args: FleetAgentArgs) -> Result<()> {
         spot_notice_url: args.spot_notice_url,
         spot_poll: Duration::from_secs(5),
         store_ready_file: args.store_ready_file.clone(),
-        aggregate: args.aggregate_port.map(|p| {
+        aggregate: args.aggregate_port.map(|port| {
             let mut argv = vec![
                 std::env::current_exe()
                     .map(|e| e.to_string_lossy().into_owned())
@@ -136,9 +200,27 @@ pub async fn run(args: FleetAgentArgs) -> Result<()> {
                 "aggregate".into(),
             ];
             argv.extend(args.aggregate_args.iter().cloned());
-            (p, argv)
+            AggregateCfg {
+                port,
+                argv,
+                public: args.aggregate_tls_port.map(|v4_port| AggregatePublic {
+                    tls_file: args.tls_dir.join(tls::FILE),
+                    v4_port,
+                    ipv4: public_ipv4.clone(),
+                    ipv6: ipv6_prefix.as_ref().map(addr::Prefix::aggregator_address),
+                }),
+            }
         }),
     };
+    // The aggregator listens on its own IPv6 address, so the host must hold it first.
+    if let Some(a) = agent
+        .aggregate
+        .as_ref()
+        .and_then(|a| a.public.as_ref())
+        .and_then(|p| p.ipv6)
+    {
+        addr::add_host_address(a).await?;
+    }
     let Some(url) = args.dial else {
         return serve(agent, tokio::io::stdin(), tokio::io::stdout()).await;
     };
@@ -248,18 +330,16 @@ where
     let (budget_tx, budget_rx) = watch::channel::<Option<BudgetBody>>(None);
     // The aggregator's layout follows the assignment and the scene.
     let (layout_tx, layout_rx) = watch::channel::<Option<Layout>>(None);
-    let aggregator = agent.aggregate.clone().map(|(port, argv)| {
-        let listen = format!("{}:{port}", cfg.publish_ip);
-        let url = slot::frame_url(&cfg.frame_host, port);
+    let aggregator = agent.aggregate.clone().map(|a| {
+        let (argv, listen) = a.command(&cfg.publish_ip);
+        let report = a.report(slot::frame_url(&cfg.frame_host, a.port));
         let out = out.clone();
         tokio::spawn(crate::fleet::aggregate::child::supervise(
             argv,
             listen,
             layout_rx,
             move || {
-                let _ = out.send(AgentMsg::Aggregate {
-                    frame_url: url.clone(),
-                });
+                let _ = out.send(report.clone());
             },
         ))
     });
diff --git a/src/fleet/coord/dns.rs b/src/fleet/coord/dns.rs
index 8629a8216..45451e995 100644
--- a/src/fleet/coord/dns.rs
+++ b/src/fleet/coord/dns.rs
@@ -7,6 +7,12 @@
 //! - `<label>-v4.<zone>` A: an IPv4 address: a GPU host's public address, shared by its
 //!   slots, each forwarded on its own port (`SlotReport::v4_port`), or a tile's own.
 //!
+//! A host's aggregator is named the same way under `agg-<host>-<token>`
+//! (`fleet_core::state::aggregate_id`): its own IPv6 address (port 443) and the host's IPv4
+//! address on the aggregator's port. Its label lasts while it reports the same addresses.
+//! The EC2 half's aggregator, which runs beside the coordinator, is `agg-ec2-<token>`: the
+//! coordinator task's own addresses, both on 443.
+//!
 //! The order is: write the records, confirm them at the zone's authoritative servers, and
 //! only then tell the coordinator (`Event::Published`), which puts the frame URLs in the
 //! state the page reads. A name is never asked for before it exists, so no resolver holds a
@@ -50,31 +56,46 @@ pub struct Fact {
     pub published: Option<Published>,
 }
 
-/// The facts of every slot and tile in the fleet.
+/// The facts of every slot, tile and aggregator in the fleet. An aggregator has one launch
+/// (generation 0) for as long as it has the same addresses.
 pub fn facts(state: &State) -> Vec<Fact> {
     let f = &state.fleet;
-    f.slots
-        .values()
-        .chain(f.ec2.values())
-        .map(|s| Fact {
-            id: s.id.clone(),
-            generation: s.observed.generation,
-            ipv6: s.observed.ipv6.clone(),
-            ipv4: s.observed.ipv4.clone(),
-            v4_port: s.observed.v4_port,
-            published: s.published.clone(),
+    let units = f.slots.values().chain(f.ec2.values()).map(|s| Fact {
+        id: s.id.clone(),
+        generation: s.observed.generation,
+        ipv6: s.observed.ipv6.clone(),
+        ipv4: s.observed.ipv4.clone(),
+        v4_port: s.observed.v4_port,
+        published: s.published.clone(),
+    });
+    let aggregators = f.hosts.values().filter_map(|h| {
+        Some(Fact {
+            id: fleet_core::state::aggregate_id(&h.name)?,
+            generation: 0,
+            ipv6: h.aggregate_ipv6.clone(),
+            ipv4: h.aggregate_ipv4.clone(),
+            v4_port: h.aggregate_v4_port,
+            published: h.aggregate_published.clone(),
         })
+    });
+    let c = &state.config;
+    let ec2_aggregator = Fact {
+        id: fleet_core::state::EC2_AGGREGATE_ID.into(),
+        generation: 0,
+        ipv6: c.ec2_aggregate_ipv6.clone(),
+        ipv4: c.ec2_aggregate_ipv4.clone(),
+        v4_port: None,
+        published: f.ec2_aggregate_published.clone(),
+    };
+    units
+        .chain(aggregators)
+        .chain(std::iter::once(ec2_aggregator))
         .collect()
 }
 
-/// An address in its canonical text (`2001:db8::2` for `2001:0db8::2`), so the record, the
-/// published names and an authoritative answer compare as the same address; text that is
-/// not an address is kept as it is.
-fn canonical(a: &str) -> String {
-    a.parse::<std::net::IpAddr>()
-        .map(|ip| ip.to_string())
-        .unwrap_or_else(|_| a.to_string())
-}
+// Addresses compare in their canonical text, so the record, the published names and an
+// authoritative answer agree on one address however it was written.
+use fleet_core::state::canonical_ip as canonical;
 
 /// Whether `p` names exactly the launch `f` is on: its generation, its addresses and the
 /// IPv4 port in its URL. Anything else is a new launch, with a new label.
@@ -170,13 +191,29 @@ pub fn mint(id: &str) -> String {
     format!("{id}-{token}")
 }
 
+/// A launch token: 8 characters of the base32 alphabet.
+fn is_token(t: &str) -> bool {
+    t.len() == 8
+        && t.bytes()
+            .all(|b| b.is_ascii_lowercase() || (b'2'..=b'7').contains(&b))
+}
+
 /// Whether a name in the zone is one this module owns: `slot-<n>` or `ec2-<n>`, optionally
-/// with a launch token, optionally with `-v4`. Anything else in the zone is never touched.
+/// with a launch token, or `agg-<host>-<token>` / `agg-ec2-<token>` (an aggregator), each optionally with
+/// `-v4`. Anything else in the zone is never touched.
 fn owned(name: &str, zone: &str) -> bool {
     let Some(label) = name.strip_suffix(&format!(".{zone}")) else {
         return false;
     };
     let label = label.strip_suffix("-v4").unwrap_or(label);
+    if let Some(rest) = label.strip_prefix("agg-") {
+        return rest.rsplit_once('-').is_some_and(|(host, token)| {
+            let id = format!("agg-{host}");
+            (fleet_core::state::aggregate_id(host).as_ref() == Some(&id)
+                || id == fleet_core::state::EC2_AGGREGATE_ID)
+                && is_token(token)
+        });
+    }
     let Some(rest) = label
         .strip_prefix("slot-")
         .or_else(|| label.strip_prefix("ec2-"))
@@ -188,12 +225,7 @@ fn owned(name: &str, zone: &str) -> bool {
         None => (rest, None),
     };
     let digits = !num.is_empty() && num.bytes().all(|b| b.is_ascii_digit());
-    let token_ok = token.is_none_or(|t| {
-        t.len() == 8
-            && t.bytes()
-                .all(|b| b.is_ascii_lowercase() || (b'2'..=b'7').contains(&b))
-    });
-    digits && token_ok
+    digits && token.is_none_or(is_token)
 }
 
 /// Whether the names of a launch answer at the zone's authoritative servers.
@@ -684,6 +716,11 @@ mod tests {
             "slot-3-abcdefgh.fcvm.dev",
             "slot-3-abcd2345-v4.fcvm.dev",
             "ec2-8-zzzzzzzz.fcvm.dev",
+            "agg-i-0123456789abcdef0-abcdefgh.fcvm.dev",
+            "agg-i-0123456789abcdef0-abcdefgh-v4.fcvm.dev",
+            "agg-gpu-a-zzzz2345.fcvm.dev",
+            "agg-ec2-abcdefgh.fcvm.dev",
+            "agg-ec2-abcdefgh-v4.fcvm.dev",
         ] {
             assert!(owned(name, z), "{name}");
         }
@@ -700,6 +737,14 @@ mod tests {
             "slot-3-ABCDEFGH.fcvm.dev",
             "slot-3-abcdefgh-x.fcvm.dev",
             "slot-3.other.dev",
+            "agg-gpu-a.fcvm.dev",
+            "agg-gpu-a-v4.fcvm.dev",
+            "agg-abcdefgh.fcvm.dev",
+            "agg--abcdefgh.fcvm.dev",
+            "agg-gpu_a-abcdefgh.fcvm.dev",
+            "agg-GPU-abcdefgh.fcvm.dev",
+            "agg-gpu-a-abcdefg1.fcvm.dev",
+            "dnstest-agg-gpu-a-abcdefgh.fcvm.dev",
         ] {
             assert!(!owned(name, z), "{name}");
         }
@@ -708,6 +753,11 @@ mod tests {
     #[test]
     fn labels_are_owned_and_not_reused() {
         let mut seen = std::collections::BTreeSet::new();
+        for id in ["slot-3", "agg-i-0123456789abcdef0"] {
+            let l = mint(id);
+            assert!(owned(&format!("{l}.fcvm.dev"), "fcvm.dev"), "{l}");
+            assert!(owned(&format!("{l}-v4.fcvm.dev"), "fcvm.dev"), "{l}");
+        }
         for _ in 0..1000 {
             let l = mint("slot-3");
             assert!(owned(&format!("{l}.fcvm.dev"), "fcvm.dev"), "{l}");
diff --git a/src/fleet/coord/ecs.rs b/src/fleet/coord/ecs.rs
new file mode 100644
index 000000000..6dbf422a9
--- /dev/null
+++ b/src/fleet/coord/ecs.rs
@@ -0,0 +1,189 @@
+//! The coordinator task's own public addresses on ECS (Fargate, awsvpc), for the EC2 half's
+//! aggregator that runs beside it: the IPv6 address from the task metadata endpoint
+//! (`ECS_CONTAINER_METADATA_URI_V4`, which lists the task's addresses, IPv6 when its subnet
+//! and the account's `dualStackIPv6` setting give one), and the public IPv4 address that
+//! EC2 associated with the task's network interface (`DescribeNetworkInterfaces` by the
+//! interface's MAC address from the metadata, which does not carry the public address). An
+//! answer that names any number of interfaces but one gives no public address.
+
+use super::aws::{signed, xml_tag, CredentialChain};
+use anyhow::{bail, Context, Result};
+use std::time::Duration;
+
+/// The public addresses: (IPv6, IPv4).
+#[derive(Debug, Clone, PartialEq)]
+pub struct TaskAddresses {
+    pub ipv6: Option<String>,
+    pub ipv4: Option<String>,
+}
+
+/// What the container metadata says of the task's network interface.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Interface {
+    pub mac: Option<String>,
+    pub private_ipv4: Option<String>,
+    /// Its global IPv6 address.
+    pub ipv6: Option<String>,
+}
+
+/// The task's interface from a container metadata answer
+/// (`GET ${ECS_CONTAINER_METADATA_URI_V4}`).
+pub fn parse_metadata(body: &str) -> Result<Interface> {
+    let v: serde_json::Value =
+        serde_json::from_str(body).context("the task metadata is not JSON")?;
+    let net = v["Networks"]
+        .as_array()
+        .and_then(|n| n.first())
+        .context("the task metadata lists no network")?;
+    let first = |k: &str| {
+        net[k]
+            .as_array()
+            .and_then(|a| a.first())
+            .and_then(|a| a.as_str())
+            .map(str::to_string)
+    };
+    let ipv6 = first("IPv6Addresses").filter(|a| {
+        a.parse::<std::net::Ipv6Addr>()
+            .is_ok_and(|ip| (ip.segments()[0] & 0xe000) == 0x2000)
+    });
+    Ok(Interface {
+        mac: net["MACAddress"].as_str().map(str::to_string),
+        private_ipv4: first("IPv4Addresses"),
+        ipv6,
+    })
+}
+
+/// The public IPv4 address in a `DescribeNetworkInterfaces` answer, when it names exactly
+/// one interface and that interface has one.
+pub fn parse_public_ip(xml: &str) -> Option<String> {
+    if xml.matches("<networkInterfaceId>").count() != 1 {
+        return None;
+    }
+    xml_tag(xml, "publicIp").filter(|a| a.parse::<std::net::Ipv4Addr>().is_ok())
+}
+
+/// Read both, with the task role's credentials, in `region` (the task's own).
+pub async fn task_addresses(region: &str) -> Result<TaskAddresses> {
+    let uri = std::env::var("ECS_CONTAINER_METADATA_URI_V4")
+        .context("ECS_CONTAINER_METADATA_URI_V4 is not set: not an ECS task")?;
+    let http = reqwest::Client::builder()
+        .no_proxy()
+        .timeout(Duration::from_secs(5))
+        .build()?;
+    let body = http
+        .get(&uri)
+        .send()
+        .await
+        .context("reading the task metadata")?
+        .error_for_status()?
+        .text()
+        .await?;
+    let iface = parse_metadata(&body)?;
+    // The MAC address names one interface in the region; a private address can repeat
+    // across VPCs.
+    let filter = match (&iface.mac, &iface.private_ipv4) {
+        (Some(mac), _) => Some(("mac-address", mac.clone())),
+        (None, Some(private)) => Some(("addresses.private-ip-address", private.clone())),
+        (None, None) => None,
+    };
+    let ipv6 = iface.ipv6;
+    let ipv4 = match filter {
+        Some((name, value)) => {
+            let chain = CredentialChain::new()?;
+            let ec2 = reqwest::Client::builder()
+                .timeout(Duration::from_secs(20))
+                .build()?;
+            let body = format!(
+                "Action=DescribeNetworkInterfaces&Version=2016-11-15&Filter.1.Name={name}&Filter.1.Value.1={}",
+                super::sigv4::uri_encode(&value)
+            );
+            let (status, bytes) = signed(
+                &chain,
+                &ec2,
+                &format!("https://ec2.{region}.amazonaws.com"),
+                reqwest::Method::POST,
+                "/",
+                "",
+                region,
+                "ec2",
+                &[(
+                    "content-type",
+                    "application/x-www-form-urlencoded; charset=utf-8".into(),
+                )],
+                body.into_bytes(),
+            )
+            .await?;
+            let xml = String::from_utf8_lossy(&bytes);
+            if !status.is_success() {
+                bail!(
+                    "EC2 DescribeNetworkInterfaces in {region} answered {status}: {}: {}",
+                    xml_tag(&xml, "Code").unwrap_or_default(),
+                    xml_tag(&xml, "Message").unwrap_or_default()
+                );
+            }
+            parse_public_ip(&xml)
+        }
+        None => None,
+    };
+    if ipv6.is_none() && ipv4.is_none() {
+        bail!("the task has neither a global IPv6 address nor a public IPv4 address");
+    }
+    Ok(TaskAddresses { ipv6, ipv4 })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_task_addresses_are_read_from_metadata_and_ec2() {
+        let dual = r#"{"DockerId":"x","Networks":[{"NetworkMode":"awsvpc",
+            "IPv4Addresses":["10.0.1.5"],"IPv6Addresses":["2001:db8:20::5"],
+            "MACAddress":"0a:00:00:00:00:01"}]}"#;
+        assert_eq!(
+            parse_metadata(dual).unwrap(),
+            Interface {
+                mac: Some("0a:00:00:00:00:01".into()),
+                private_ipv4: Some("10.0.1.5".into()),
+                ipv6: Some("2001:db8:20::5".into()),
+            }
+        );
+        let v4_only = r#"{"Networks":[{"IPv4Addresses":["10.0.1.5"]}]}"#;
+        assert_eq!(
+            parse_metadata(v4_only).unwrap(),
+            Interface {
+                mac: None,
+                private_ipv4: Some("10.0.1.5".into()),
+                ipv6: None,
+            }
+        );
+        // A link-local or unique-local address is not one a browser reaches.
+        let ula = r#"{"Networks":[{"IPv4Addresses":["10.0.1.5"],"IPv6Addresses":["fd00::5"]}]}"#;
+        assert_eq!(parse_metadata(ula).unwrap().ipv6, None);
+        assert!(parse_metadata(r#"{"Networks":[]}"#).is_err());
+
+        let xml = "<DescribeNetworkInterfacesResponse><networkInterfaceSet><item>\
+            <networkInterfaceId>eni-0</networkInterfaceId><association>\
+            <publicIp>192.0.2.44</publicIp><ipOwnerId>amazon</ipOwnerId></association>\
+            <privateIpAddress>10.0.1.5</privateIpAddress></item></networkInterfaceSet>\
+            </DescribeNetworkInterfacesResponse>";
+        assert_eq!(parse_public_ip(xml).as_deref(), Some("192.0.2.44"));
+        assert_eq!(
+            parse_public_ip("<networkInterfaceSet><item></item></networkInterfaceSet>"),
+            None
+        );
+    }
+
+    /// An answer that names more than one interface (the same private address in another
+    /// VPC) must not give either one's public address to the aggregator.
+    #[test]
+    fn an_answer_naming_two_interfaces_publishes_neither_address() {
+        let two = "<DescribeNetworkInterfacesResponse><networkInterfaceSet>\
+            <item><networkInterfaceId>eni-0</networkInterfaceId><association>\
+            <publicIp>192.0.2.44</publicIp></association></item>\
+            <item><networkInterfaceId>eni-1</networkInterfaceId><association>\
+            <publicIp>192.0.2.45</publicIp></association></item>\
+            </networkInterfaceSet></DescribeNetworkInterfacesResponse>";
+        assert_eq!(parse_public_ip(two), None);
+    }
+}
diff --git a/src/fleet/coord/mod.rs b/src/fleet/coord/mod.rs
index 404f4e2cc..457290f5f 100644
--- a/src/fleet/coord/mod.rs
+++ b/src/fleet/coord/mod.rs
@@ -14,6 +14,7 @@ pub mod cert;
 pub mod dns;
 pub mod ec2;
 pub mod ec2_aws;
+pub mod ecs;
 pub mod live;
 pub mod poster;
 pub mod scale;
@@ -429,12 +430,17 @@ impl Actor {
                 let d = &f.director;
                 // Only aggregators with a region: one without (a host whose GPUs are all
                 // on standby, the EC2 side with no tile) never sends a frame, and the
-                // capture waits for every source.
+                // capture waits for every source. A host aggregator is read at its
+                // published name when it has one (IPv4 first): the URL its agent reported
+                // can be an address only that host reaches.
                 let mut sources: Vec<String> = f
                     .hosts
                     .values()
                     .filter(|h| h.region.is_some())
-                    .filter_map(|h| h.aggregate_url.clone())
+                    .filter_map(|h| {
+                        let (v6, v4) = fleet_core::view::host_aggregate_urls(&self.state, h);
+                        v4.or(v6).or_else(|| h.aggregate_url.clone())
+                    })
                     .collect();
                 if let Some(u) = self
                     .ec2_aggregate_local
@@ -905,6 +911,28 @@ pub fn power_managed(args: &FleetCoordArgs) -> bool {
 }
 
 pub async fn run(args: FleetCoordArgs) -> Result<()> {
+    if args.ec2_aggregate_listen.is_some()
+        && args.ec2_aggregate_url.is_none()
+        && !args.ec2_aggregate_tls
+    {
+        bail!("--ec2-aggregate-listen needs --ec2-aggregate-url or --ec2-aggregate-tls (how browsers reach it)");
+    }
+    let secrets_region = || {
+        args.secrets_region
+            .clone()
+            .or_else(|| std::env::var("AWS_REGION").ok())
+            .context("reading a secret needs --secrets-region or AWS_REGION")
+    };
+    // The EC2 aggregator serving browsers: the task's own addresses, fixed for its life.
+    let ec2_public = if args.ec2_aggregate_tls {
+        let region = std::env::var("AWS_REGION")
+            .context("--ec2-aggregate-tls reads the task's addresses in AWS_REGION")?;
+        let a = ecs::task_addresses(&region).await?;
+        tracing::info!(ipv6 = ?a.ipv6, ipv4 = ?a.ipv4, "the EC2 aggregator's public addresses");
+        Some(a)
+    } else {
+        None
+    };
     let config = Config {
         max_tiles: args.max_tiles,
         ec2_max: match args.ec2 {
@@ -912,6 +940,8 @@ pub async fn run(args: FleetCoordArgs) -> Result<()> {
             FleetEc2::Fake | FleetEc2::Aws => args.ec2_tiles.min(args.max_tiles),
         },
         ec2_aggregate_url: args.ec2_aggregate_url.clone(),
+        ec2_aggregate_ipv6: ec2_public.as_ref().and_then(|a| a.ipv6.clone()),
+        ec2_aggregate_ipv4: ec2_public.as_ref().and_then(|a| a.ipv4.clone()),
         race_interval_secs: args.race_every,
         restart_cooldown_secs: args.restart_cooldown,
         camera_seed: args.camera_seed,
@@ -1005,12 +1035,6 @@ pub async fn run(args: FleetCoordArgs) -> Result<()> {
             spot_wait: Duration::from_secs(args.spot_wait),
         })
     };
-    let secrets_region = || {
-        args.secrets_region
-            .clone()
-            .or_else(|| std::env::var("AWS_REGION").ok())
-            .context("reading a secret needs --secrets-region or AWS_REGION")
-    };
     let dns_token = match &args.dns_token_secret {
         Some(name) => Some(
             secrets::Secrets::new(&secrets_region()?)?
@@ -1111,6 +1135,24 @@ pub async fn run(args: FleetCoordArgs) -> Result<()> {
             "aggregate".into(),
         ];
         argv.extend(args.aggregate_args.iter().cloned());
+        if let (Some(a), Some(secret)) = (&ec2_public, &args.tls_secret) {
+            // The certificate file, written before the aggregator starts and kept current.
+            use crate::fleet::agent::tls;
+            let dir = args.ec2_aggregate_tls_dir.clone();
+            let secrets = secrets::Secrets::new(&secrets_region()?)?;
+            tls::refresh(&secrets, secret, &dir).await?;
+            tokio::spawn(tls::run(secrets, secret.clone(), dir.clone()));
+            argv.extend([
+                "--tls-file".into(),
+                dir.join(tls::FILE).to_string_lossy().into_owned(),
+            ]);
+            if a.ipv4.is_some() {
+                argv.extend(["--tls-listen".into(), format!("0.0.0.0:{}", tls::PORT)]);
+            }
+            if let Some(v6) = &a.ipv6 {
+                argv.extend(["--tls-listen".into(), format!("[{v6}]:{}", tls::PORT)]);
+            }
+        }
         tokio::spawn(crate::fleet::aggregate::child::supervise(
             argv,
             listen.clone(),
diff --git a/src/network/routed.rs b/src/network/routed.rs
index b9c22f1c7..ff29fa9e6 100644
--- a/src/network/routed.rs
+++ b/src/network/routed.rs
@@ -1531,7 +1531,7 @@ async fn detect_ipv6_dns(selected: Option<String>) -> Option<String> {
 }
 
 /// Detect the default IPv6 outgoing interface
-async fn detect_default_ipv6_interface() -> Option<String> {
+pub(crate) async fn detect_default_ipv6_interface() -> Option<String> {
     let output = tokio::process::Command::new("ip")
         .args(["-6", "route", "show", "default"])
         .output()
diff --git a/tests/test_fleet_agent.rs b/tests/test_fleet_agent.rs
index 1035a477c..fe9042614 100644
--- a/tests/test_fleet_agent.rs
+++ b/tests/test_fleet_agent.rs
@@ -5,7 +5,7 @@
 mod fleet_support;
 
 use fcvm::fleet::agent::slot::AgentCfg;
-use fcvm::fleet::agent::{serve, Agent};
+use fcvm::fleet::agent::{serve, Agent, AggregateCfg, AggregatePublic};
 use fcvm::fleet::lines::{spawn_writer, LineReader};
 use fleet_core::protocol::{AgentMsg, AssignSlot, CoordMsg, SharedScene, SlotReport};
 use fleet_core::scene::Scene;
@@ -940,14 +940,27 @@ async fn a_spot_notice_is_reported_as_draining() {
 
 /// With an aggregator port the agent runs `fcvm fleet aggregate` for its band, reports its
 /// frame URL, and gives it the layout: the assigned region and every placed slot's renderer.
+/// Serving browsers, the aggregator listens with TLS on its IPv4 port (with the renderers'
+/// certificate file) and the agent reports the host's public IPv4 address with that port.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn the_agent_runs_and_feeds_its_aggregator() {
     let f = fake(2, &[]);
-    let port = std::net::TcpListener::bind("127.0.0.1:0")
-        .unwrap()
-        .local_addr()
-        .unwrap()
-        .port();
+    let free_port = || {
+        std::net::TcpListener::bind("127.0.0.1:0")
+            .unwrap()
+            .local_addr()
+            .unwrap()
+            .port()
+    };
+    let (port, tls_port) = (free_port(), free_port());
+    let tls_dir = tempfile::tempdir().unwrap();
+    let ck = rcgen::generate_simple_self_signed(vec!["agg.fleet.test".to_string()]).unwrap();
+    std::fs::write(
+        tls_dir.path().join("tls.json"),
+        serde_json::json!({"cert": ck.cert.pem(), "key": ck.signing_key.serialize_pem()})
+            .to_string(),
+    )
+    .unwrap();
     let (coord_side, agent_side) = tokio::io::duplex(1 << 20);
     let (agent_in, agent_out) = tokio::io::split(agent_side);
     let (coord_in, coord_out) = tokio::io::split(coord_side);
@@ -960,16 +973,22 @@ async fn the_agent_runs_and_feeds_its_aggregator() {
         spot_notice_url: None,
         spot_poll: Duration::from_millis(50),
         store_ready_file: None,
-        aggregate: Some((
+        aggregate: Some(AggregateCfg {
             port,
-            vec![
+            argv: vec![
                 env!("CARGO_BIN_EXE_fcvm").to_string(),
                 "fleet".into(),
                 "aggregate".into(),
                 "--codec".into(),
                 "raw".into(),
             ],
-        )),
+            public: Some(AggregatePublic {
+                tls_file: tls_dir.path().join("tls.json"),
+                v4_port: tls_port,
+                ipv4: Some("192.0.2.7".into()),
+                ipv6: None,
+            }),
+        }),
     };
     let task = tokio::spawn(serve(agent, agent_in, agent_out));
     let (to_agent, _w) = spawn_writer::<CoordMsg, _>(coord_out, "agent");
@@ -1023,11 +1042,45 @@ async fn the_agent_runs_and_feeds_its_aggregator() {
             .expect("an agent message")
             .unwrap()
             .unwrap();
-        if let AgentMsg::Aggregate { frame_url } = m {
+        if let AgentMsg::Aggregate {
+            frame_url,
+            ipv6,
+            ipv4,
+            v4_port,
+        } = m
+        {
             assert_eq!(frame_url, format!("ws://gpu-host.example:{port}/frames"));
+            assert_eq!(
+                (ipv6, ipv4.as_deref(), v4_port),
+                (None, Some("192.0.2.7"), Some(tls_port))
+            );
             break;
         }
     }
+    // Browsers: TLS on the IPv4 port, the stream and the health check only.
+    let https = reqwest::Client::builder()
+        .use_rustls_tls()
+        .tls_built_in_root_certs(false)
+        .add_root_certificate(reqwest::Certificate::from_pem(ck.cert.pem().as_bytes()).unwrap())
+        .resolve(
+            "agg.fleet.test",
+            std::net::SocketAddr::from(([127, 0, 0, 1], tls_port)),
+        )
+        .no_proxy()
+        .build()
+        .unwrap();
+    let r = https
+        .get(format!("https://agg.fleet.test:{tls_port}/healthz"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(r.status(), 200);
+    let r = https
+        .get(format!("https://agg.fleet.test:{tls_port}/layout"))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(r.status(), 404, "the layout is not served to browsers");
     let layout_url = format!("http://127.0.0.1:{port}/layout");
     let deadline = Instant::now() + Duration::from_secs(10);
     let layout = loop {
diff --git a/tests/test_fleet_coord.rs b/tests/test_fleet_coord.rs
index ade55905f..58a868d45 100644
--- a/tests/test_fleet_coord.rs
+++ b/tests/test_fleet_coord.rs
@@ -996,6 +996,9 @@ async fn the_poster_is_the_whole_image_at_a_hold() {
         .to_coord
         .send(AgentMsg::Aggregate {
             frame_url: host_agg,
+            ipv6: None,
+            ipv4: None,
+            v4_port: None,
         })
         .unwrap();
     agent.report("slot-1", "running", 1);
@@ -1995,6 +1998,7 @@ async fn a_failed_state_write_is_retried_while_the_state_is_unchanged() {
         scene: tokio::sync::watch::channel(None).0,
         budget: tokio::sync::watch::channel(None).0,
         dns: None,
+        zone: None,
         store: Some(tx),
     };
     let (cmds, cmds_rx) = tokio::sync::mpsc::channel(64);
@@ -3012,6 +3016,9 @@ async fn no_poster_is_planned_while_tiles_start_or_race() {
         .to_coord
         .send(AgentMsg::Aggregate {
             frame_url: "ws://gpu-host.example:20200/frames".into(),
+            ipv6: None,
+            ipv4: None,
+            v4_port: None,
         })
         .unwrap();
     // Nor while the tiles are still starting (the first poster of a GPU run was black).
@@ -3087,6 +3094,9 @@ async fn a_poster_plan_names_only_placed_aggregators() {
     a.to_coord
         .send(AgentMsg::Aggregate {
             frame_url: "ws://gpu-a.example:20200/frames".into(),
+            ipv6: None,
+            ipv4: None,
+            v4_port: None,
         })
         .unwrap();
     // gpu-b's only GPU is on standby: max_tiles is taken by gpu-a.
@@ -3094,6 +3104,9 @@ async fn a_poster_plan_names_only_placed_aggregators() {
     b.to_coord
         .send(AgentMsg::Aggregate {
             frame_url: "ws://gpu-b.example:20200/frames".into(),
+            ipv6: None,
+            ipv4: None,
+            v4_port: None,
         })
         .unwrap();
     // A scrub after it on the same connection shows when gpu-b's aggregate is applied.
@@ -3964,6 +3977,14 @@ struct DnsFixture {
 }
 
 async fn dns_fixture(pre: &[(&str, &str, &str)]) -> DnsFixture {
+    dns_fixture_with(pre, Config::default(), None).await
+}
+
+async fn dns_fixture_with(
+    pre: &[(&str, &str, &str)],
+    config: Config,
+    ec2: Option<Arc<dyn ec2::Ec2Driver>>,
+) -> DnsFixture {
     use fcvm::fleet::coord::dns::Cloudflare;
     let cf = FakeCf::default();
     for (i, (kind, name, content)) in pre.iter().enumerate() {
@@ -3987,9 +4008,9 @@ async fn dns_fixture(pre: &[(&str, &str, &str)]) -> DnsFixture {
     .unwrap()
     .with_confirm(Arc::new(gate.clone()));
     let (handle, _actor) = start(
-        State::new(Config::default(), now_ms()),
-        None,
+        State::new(config, now_ms()),
         None,
+        ec2,
         None,
         None,
         Some(fcvm::fleet::coord::Names::Cloudflare(writer)),
@@ -4237,6 +4258,162 @@ async fn each_launch_gets_new_names_and_old_ones_go_once_unreferenced() {
     );
 }
 
+impl DnsFixture {
+    fn aggregate_report(&self, v6: Option<&str>, v4: Option<&str>) {
+        self.agent
+            .to_coord
+            .send(AgentMsg::Aggregate {
+                frame_url: "ws://gpu-a.internal:20300/frames".into(),
+                ipv6: v6.map(str::to_string),
+                ipv4: v4.map(str::to_string),
+                v4_port: v4.map(|_| 20208),
+            })
+            .unwrap();
+    }
+
+    fn aggregate(&self) -> Value {
+        self.aggregate_of("agg:gpu-a")
+    }
+
+    fn aggregate_of(&self, id: &str) -> Value {
+        let state =
+            &serde_json::from_str::<Value>(&self.handle.snapshot.borrow().text).unwrap()["state"];
+        state["aggregates"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|a| a["id"] == id)
+            .cloned()
+            .unwrap_or(Value::Null)
+    }
+}
+
+/// The EC2 half's aggregator serving browsers with TLS is named `agg-ec2-<token>` at the
+/// coordinator's own addresses, both on 443, and its URLs reach the page only once the
+/// names answer.
+#[tokio::test]
+async fn the_ec2_aggregator_is_published_at_the_coordinators_addresses() {
+    let config = Config {
+        ec2_max: 1,
+        ec2_aggregate_ipv6: Some("2001:db8:20::5".into()),
+        ec2_aggregate_ipv4: Some("192.0.2.44".into()),
+        ..Config::default()
+    };
+    let ec2: Arc<dyn ec2::Ec2Driver> = Arc::new(ec2::FakeEc2::new(
+        Duration::from_millis(10),
+        Duration::from_millis(10),
+    ));
+    let fx = dns_fixture_with(&[], config, Some(ec2)).await;
+    fx.wait_until("the EC2 half's region", |fx| {
+        !fx.aggregate_of("agg:ec2").is_null()
+    })
+    .await;
+    let label = fx.label_for("2001:db8:20::5").await;
+    assert!(
+        label.starts_with("agg-ec2-") && label.len() == "agg-ec2-".len() + 8,
+        "{label}"
+    );
+    fx.wait_until("the A record", |fx| {
+        fx.zone().contains(&(
+            "A".into(),
+            format!("{label}-v4.fcvm.example"),
+            "192.0.2.44".into(),
+        ))
+    })
+    .await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert!(
+        fx.aggregate_of("agg:ec2")["frame_url"].is_null(),
+        "{}",
+        fx.aggregate_of("agg:ec2")
+    );
+    fx.open(true);
+    fx.wait_until("the EC2 aggregator published", |fx| {
+        !fx.aggregate_of("agg:ec2")["frame_url"].is_null()
+    })
+    .await;
+    let a = fx.aggregate_of("agg:ec2");
+    assert_eq!(a["frame_url"], format!("wss://{label}.fcvm.example/frames"));
+    assert_eq!(
+        a["frame_url_v4"],
+        format!("wss://{label}-v4.fcvm.example/frames")
+    );
+}
+
+/// A host aggregator that serves browsers is named like a launch, under
+/// `agg-<host>-<token>`: its own IPv6 address and the host's IPv4 address on the
+/// aggregator's port, written, confirmed, and only then given to the page. Before that,
+/// and for an aggregator that reports no public address, the page gets no URL (it is https
+/// and cannot open the aggregator's plain one). A new address is a new label, and the old
+/// names go once unreferenced.
+#[tokio::test]
+async fn a_host_aggregator_is_published_under_its_own_names() {
+    let fx = dns_fixture(&[]).await;
+    fx.report("running", 1, Some("2001:db8::2"), Some("192.0.2.10"));
+    fx.wait_until("the host's band", |fx| !fx.aggregate().is_null())
+        .await;
+    fx.aggregate_report(None, None);
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert!(
+        fx.aggregate()["frame_url"].is_null() && fx.aggregate()["frame_url_v4"].is_null(),
+        "the plain URL reached an https page: {}",
+        fx.aggregate()
+    );
+    assert!(
+        !fx.zone().iter().any(|(_, n, _)| n.starts_with("agg-")),
+        "{:?}",
+        fx.zone()
+    );
+
+    fx.aggregate_report(Some("2001:db8::1"), Some("192.0.2.10"));
+    let label = fx.label_for("2001:db8::1").await;
+    assert!(
+        label.starts_with("agg-gpu-a-") && label.len() == "agg-gpu-a-".len() + 8,
+        "{label}"
+    );
+    fx.wait_until("the A record", |fx| {
+        fx.zone().contains(&(
+            "A".into(),
+            format!("{label}-v4.fcvm.example"),
+            "192.0.2.10".into(),
+        ))
+    })
+    .await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert!(fx.aggregate()["frame_url"].is_null(), "{}", fx.aggregate());
+    fx.open(true);
+    fx.wait_until("the aggregator published", |fx| {
+        !fx.aggregate()["frame_url"].is_null()
+    })
+    .await;
+    assert_eq!(
+        fx.aggregate()["frame_url"],
+        format!("wss://{label}.fcvm.example/frames")
+    );
+    assert_eq!(
+        fx.aggregate()["frame_url_v4"],
+        format!("wss://{label}-v4.fcvm.example:20208/frames")
+    );
+
+    // Another address (a new host prefix): the old names are hidden at once, the new ones
+    // shown once confirmed, and the old records removed.
+    fx.open(false);
+    fx.aggregate_report(Some("2001:db8:5::1"), Some("192.0.2.10"));
+    let second = fx.label_for("2001:db8:5::1").await;
+    assert_ne!(label, second);
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert!(fx.aggregate()["frame_url"].is_null(), "{}", fx.aggregate());
+    fx.open(true);
+    fx.wait_until("the new address published", |fx| {
+        fx.aggregate()["frame_url"] == format!("wss://{second}.fcvm.example/frames")
+    })
+    .await;
+    fx.wait_until("the old names removed", |fx| {
+        !fx.zone().iter().any(|(_, n, _)| n.starts_with(&label))
+    })
+    .await;
+}
+
 /// A DNS query for `name` and `qtype` to `server` over UDP (or TCP): the rcode, whether AA
 /// is set, and the addresses of the answer.
 async fn ask_dns(