diff --git a/switch_remote.sh b/switch_remote.sh
index 75f7374..0d42d13 100755
--- a/switch_remote.sh
+++ b/switch_remote.sh
@@ -13,4 +13,4 @@ exec nixos-rebuild $ACTION \
   --use-remote-sudo \
   --build-host $HOST \
   --target-host $HOST \
-  --flake ".#${CONFIG}.noc.eh22.intern"
+  --flake ".#${CONFIG}"
diff --git a/systems/cookies.eh22.intern.nix b/systems/cookies.eh22.intern.nix
new file mode 100644
index 0000000..7e68cf0
--- /dev/null
+++ b/systems/cookies.eh22.intern.nix
@@ -0,0 +1,26 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+{
+  imports = [ ];
+
+  # configure static IP address
+  networking.useDHCP = false;
+  systemd.network = {
+    enable = true;
+    networks = {
+      "10-eth0" = {
+        matchConfig.MACAddress = "BC:24:11:41:E1:61";
+        address = [ "10.0.0.3/24" ];
+        gateway = [ "10.0.0.1" ];
+      };
+    };
+  };
+
+  # DO NOT CHANGE
+  # this defines the first version of NixOS that was installed on the machine so that programs with non-migratable data files are kept compatible
+  home-manager.users.noc.home.stateVersion = "24.11";
+  system.stateVersion = "24.11";
+}
diff --git a/systems/default.nix b/systems/default.nix
index d0b01c8..347efbc 100644
--- a/systems/default.nix
+++ b/systems/default.nix
@@ -41,11 +41,14 @@ let
     };
 in
 {
-  # prod hosts
+  # prod hosts (mgmt)
   "auth-dns.noc.eh22.intern" = mkSystem "x86_64-linux" "auth-dns.noc.eh22.intern";
   "resolv-dns.noc.eh22.intern" = mkSystem "x86_64-linux" "resolv-dns.noc.eh22.intern";
   "monitoring.noc.eh22.intern" = mkSystem "x86_64-linux" "monitoring.noc.eh22.intern";
 
+  # prod hosts (public user)
+  "cookies.eh22.intern" = mkSystem "x86_64-linux" "cookies.eh22.intern";
+
   # staging temp infra
   "sketchy-router.noc.eh22.intern" = mkSystem "x86_64-linux" "sketchy-router.noc.eh22.intern";