diff --git a/mandelstudio/middleware.py b/mandelstudio/middleware.py
new file mode 100644
index 0000000..8e96b4f
--- /dev/null
+++ b/mandelstudio/middleware.py
@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from django.http import HttpRequest, HttpResponsePermanentRedirect
+
+
+class RedirectApexToWwwMiddleware:
+    """Redirect `mandelblog.com` to `www.mandelblog.com` for production.
+
+    We keep this project-scoped and host-specific so staging hostnames and other
+    Mandel environments are unaffected.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest):
+        host = (request.get_host() or "").split(":")[0].lower()
+        if host == "mandelblog.com":
+            destination = request.build_absolute_uri().replace(
+                "://mandelblog.com", "://www.mandelblog.com", 1
+            )
+            return HttpResponsePermanentRedirect(destination)
+        return self.get_response(request)
+
diff --git a/mandelstudio/settings/base.py b/mandelstudio/settings/base.py
index 9b00ab7..1ced570 100644
--- a/mandelstudio/settings/base.py
+++ b/mandelstudio/settings/base.py
@@ -116,6 +116,10 @@ if "django.middleware.locale.LocaleMiddleware" not in MIDDLEWARE:
     else:
         MIDDLEWARE.insert(0, "django.middleware.locale.LocaleMiddleware")
 
+# Redirect production apex to `www` for a single canonical domain.
+if "mandelstudio.middleware.RedirectApexToWwwMiddleware" not in MIDDLEWARE:
+    MIDDLEWARE.insert(0, "mandelstudio.middleware.RedirectApexToWwwMiddleware")
+
 LANGUAGE_CODE = "nl"
 LANGUAGES = [
     ("nl", "Nederlands"),