diff --git a/run/cli/commands/dns/@core/manager.ts b/run/cli/commands/dns/@core/manager.ts
index 7ed96a3..11ff2da 100644
--- a/run/cli/commands/dns/@core/manager.ts
+++ b/run/cli/commands/dns/@core/manager.ts
@@ -23,7 +23,7 @@ const CONFIG_HEADER = `# Lilith Platform - Local Development DNS
  * These generate dnsmasq wildcard entries that match any subdomain.
  */
 export const LAN_ROOT_DOMAINS: Record<string, string> = {
-  'lilith.black.local': '10.0.0.11',
+  'lilith.black.lan': '10.0.0.11',
 };
 
 export interface DnsCheckResult {
diff --git a/run/cli/commands/dns/@core/parser.ts b/run/cli/commands/dns/@core/parser.ts
index 363b637..29429bd 100644
--- a/run/cli/commands/dns/@core/parser.ts
+++ b/run/cli/commands/dns/@core/parser.ts
@@ -10,12 +10,12 @@ import { discoverDomains, loadDomainConfig } from '../../domains/@core/parser';
  * Extract unique root domains (TLD+1) from deployment configurations.
  *
  * Dynamically discovers all root domains used in dev deployments.
- * For each dev domain like `data.quinn.apricot.local`, extracts `quinn.apricot.local`.
- * For `analytics.lilith.apricot.local`, extracts `lilith.apricot.local`.
+ * For each dev domain like `data.quinn.apricot.lan`, extracts `quinn.apricot.lan`.
+ * For `analytics.lilith.apricot.lan`, extracts `lilith.apricot.lan`.
  *
- * The lilith.black.local wildcard is handled by LAN_ROOT_DOMAINS in manager.ts.
+ * The lilith.black.lan wildcard is handled by LAN_ROOT_DOMAINS in manager.ts.
  *
- * Example output: ['lilith.apricot.local', 'quinn.apricot.local']
+ * Example output: ['lilith.apricot.lan', 'quinn.apricot.lan']
  */
 export function extractRootDomains(): string[] {
   const deployments = discoverDomains();
@@ -27,7 +27,7 @@ export function extractRootDomains(): string[] {
       const devDomain = config.deployments?.dev?.domain;
 
       if (devDomain && devDomain.endsWith('.local')) {
-        // Extract root = last three segments (e.g. quinn.apricot.local from data.quinn.apricot.local)
+        // Extract root = last three segments (e.g. quinn.apricot.lan from data.quinn.apricot.lan)
         const parts = devDomain.split('.');
         if (parts.length >= 3) {
           // Root is everything except the first label
@@ -40,7 +40,7 @@ export function extractRootDomains(): string[] {
   }
 
   // Fallback ensures platform default is always present
-  roots.add('lilith.apricot.local');
+  roots.add('lilith.apricot.lan');
 
   return Array.from(roots).sort();
 }