diff --git a/.gitignore b/.gitignore
index 53f0b57..a67f3b0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,10 +6,11 @@ runtime/authlib-injector.jar
 # rendered configs (from tooling/render-config.sh)
 drasl/config/config.toml
 dnsmasq/dnsmasq.conf
-# packwiz external-file metadata + index are rendered from *.pw.toml.tmpl
+# packwiz pack files rendered from pack/**/*.tmpl by tooling/render-pack.sh
 # (domain-dependent build output); source of truth is the .tmpl + custom/ jars.
 pack/mods/*.pw.toml
 pack/index.toml
+pack/CustomSkinLoader/CustomSkinLoader.json
 
 # vendored / mirrored binaries
 mirror/
diff --git a/pack/.packwizignore b/pack/.packwizignore
index 37ea812..c15a823 100644
--- a/pack/.packwizignore
+++ b/pack/.packwizignore
@@ -1,3 +1,3 @@
-# Template sources for external-file metadata — rendered to *.pw.toml by
-# tooling/render-config.sh. packwiz must NOT index the templates themselves.
-*.pw.toml.tmpl
+# Template sources for pack metadata/config — rendered to their real files by
+# tooling/render-pack.sh. packwiz must NOT index the templates themselves.
+*.tmpl
diff --git a/pack/CustomSkinLoader/CustomSkinLoader.json b/pack/CustomSkinLoader/CustomSkinLoader.json.tmpl
similarity index 51%
rename from pack/CustomSkinLoader/CustomSkinLoader.json
rename to pack/CustomSkinLoader/CustomSkinLoader.json.tmpl
index aa3449e..539817c 100644
--- a/pack/CustomSkinLoader/CustomSkinLoader.json
+++ b/pack/CustomSkinLoader/CustomSkinLoader.json.tmpl
@@ -4,9 +4,8 @@
         {
             "name": "Ulicraft Skins",
             "type": "MojangAPI",
-            "apiRoot": "https://auth.ulicraft.net/account/",
-            "sessionRoot": "https://auth.ulicraft.net/session/"
+            "apiRoot": "https://auth.${BASE_DOMAIN}/account/",
+            "sessionRoot": "https://auth.${BASE_DOMAIN}/session/"
         }
     ]
 }
-
diff --git a/pack/pack.toml b/pack/pack.toml
index 3ce3b45..f663aec 100644
--- a/pack/pack.toml
+++ b/pack/pack.toml
@@ -6,7 +6,7 @@ pack-format = "packwiz:1.1.0"
 [index]
 file = "index.toml"
 hash-format = "sha256"
-hash = "36d9f52476a127af5837a65e69d25dc1cd9f7e131eb5a76166378351bf40a009"
+hash = "9bca0b1a4434050835cab46116d7c14aafec971ff5a95a1ee0c4232c8bcbc355"
 
 [versions]
 minecraft = "1.21.1"
diff --git a/tooling/add-custom-mod.sh b/tooling/add-custom-mod.sh
index 06c27c2..de9aa46 100755
--- a/tooling/add-custom-mod.sh
+++ b/tooling/add-custom-mod.sh
@@ -124,17 +124,9 @@ log "adding ${#JARS[@]} jar(s), side=${SIDE}"
 for j in "${JARS[@]}"; do add_one "$j"; done
 
 # ---- render + refresh once -------------------------------------------------
-# Render every metadata template -> .pw.toml (inject ${BASE_DOMAIN} only — no
-# coupling to dnsmasq's HOST_LAN_IP), then rebuild the packwiz index. This is
-# the same render render-config.sh does at deploy; kept inline so adding a mod
-# works with just BASE_DOMAIN set.
+# render-pack.sh renders all pack templates (BASE_DOMAIN only) + rebuilds the
+# packwiz index. Single source of pack-render logic, shared with render-config.
 log "rendering metadata + refreshing index"
-for t in pack/mods/*.pw.toml.tmpl; do
-  envsubst '${BASE_DOMAIN}' < "$t" > "${t%.tmpl}"
-done
-# index.toml is gitignored build output; seed a minimal one so packwiz refresh
-# (which won't bootstrap a missing index) has something to populate.
-[ -f pack/index.toml ] || printf 'hash-format = "sha256"\n' > pack/index.toml
-( cd pack && packwiz refresh )
+tooling/render-pack.sh
 log "done — ${#JARS[@]} mod(s) added to the pack"
 echo "  commit: custom/*.jar + pack/mods/*.pw.toml.tmpl  (rendered .pw.toml/index are gitignored)"
diff --git a/tooling/render-config.sh b/tooling/render-config.sh
index 1a2b289..62163f9 100755
--- a/tooling/render-config.sh
+++ b/tooling/render-config.sh
@@ -20,18 +20,6 @@ render() {  # $1=template  $2=output
 render drasl/config/config.toml.tmpl drasl/config/config.toml
 render dnsmasq/dnsmasq.conf.tmpl      dnsmasq/dnsmasq.conf
 
-# packwiz external-file metadata: render every pack/mods/*.pw.toml.tmpl into its
-# .pw.toml (injects ${BASE_DOMAIN} into the download URL), then rebuild the
-# packwiz index. .packwizignore keeps the .tmpl out of the index.
-shopt -s nullglob
-tmpls=(pack/mods/*.pw.toml.tmpl)
-shopt -u nullglob
-if [ "${#tmpls[@]}" -gt 0 ]; then
-  for t in "${tmpls[@]}"; do render "$t" "${t%.tmpl}"; done
-  command -v packwiz >/dev/null 2>&1 || { echo "packwiz not found — cannot refresh index" >&2; exit 1; }
-  # index.toml is gitignored build output; seed a minimal one so packwiz refresh
-  # (which won't bootstrap a missing index) has something to populate.
-  [ -f pack/index.toml ] || printf 'hash-format = "sha256"\n' > pack/index.toml
-  ( cd pack && packwiz refresh )
-  echo "refreshed packwiz index (${#tmpls[@]} external metafiles)"
-fi
+# pack templates (mods/*.pw.toml.tmpl, CustomSkinLoader, …) + packwiz index.
+# Delegated to render-pack.sh (BASE_DOMAIN only — single source of pack render).
+tooling/render-pack.sh
diff --git a/tooling/render-pack.sh b/tooling/render-pack.sh
new file mode 100755
index 0000000..c657dea
--- /dev/null
+++ b/tooling/render-pack.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# render-pack.sh — render every pack template (pack/**/*.tmpl) by injecting
+# ${BASE_DOMAIN}, then rebuild the packwiz index.
+#
+# Pack templates are domain-dependent build output (download URLs, skin API
+# roots, …). This renderer needs ONLY ${BASE_DOMAIN} — no dnsmasq HOST_LAN_IP —
+# so it can run while curating mods before the full deploy config exists.
+# Both tooling/render-config.sh (deploy) and tooling/add-custom-mod.sh call it.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."   # repo root
+
+[ -f .env ] && { set -a; . ./.env; set +a; }
+: "${BASE_DOMAIN:?BASE_DOMAIN unset (set in .env)}"
+command -v envsubst >/dev/null 2>&1 || { echo "missing required tool: envsubst (gettext)" >&2; exit 1; }
+command -v packwiz  >/dev/null 2>&1 || { echo "missing required tool: packwiz" >&2; exit 1; }
+[ -f pack/pack.toml ] || { echo "pack/pack.toml not found" >&2; exit 1; }
+
+shopt -s globstar nullglob
+tmpls=(pack/**/*.tmpl)
+shopt -u globstar nullglob
+
+for t in "${tmpls[@]}"; do
+  # Substitute ONLY ${BASE_DOMAIN} so any other literal $-syntax is preserved.
+  envsubst '${BASE_DOMAIN}' < "$t" > "${t%.tmpl}"
+  echo "rendered ${t%.tmpl}"
+done
+
+# index.toml is gitignored build output; seed a minimal one so packwiz refresh
+# (which won't bootstrap a missing index) has something to populate.
+[ -f pack/index.toml ] || printf 'hash-format = "sha256"\n' > pack/index.toml
+( cd pack && packwiz refresh )
+echo "packwiz index refreshed (${#tmpls[@]} template(s))"