diff --git a/asset/config/config.toml.tmpl b/asset/config/config.toml.tmpl
index 0d872e5..7b2706b 100644
--- a/asset/config/config.toml.tmpl
+++ b/asset/config/config.toml.tmpl
@@ -92,8 +92,32 @@ mainnet = true
 # stays in the site's navigation; it is simply no longer navigable, because
 # authorship comes from headers and we no longer hold an endpoint that serves
 # them. That is the ordinary `no_endpoint` state, not an outage.
-rpc_url = "http://127.0.0.1:9944"
-ws_url = "ws://127.0.0.1:9944"
+# Our own node first, and it must stay first: loopback pays no network hop, and
+# `127.0.0.1/32` is the only address whitelisted against the node's own
+# `--rpc-rate-limit 300`. Reaching it by its mesh name instead would cap the
+# backfill at a hundred blocks a minute for no reason.
+#
+# The two public archive nodes behind it are the fallback. They were not easy to
+# find: mainnet uses a different domain *and* a different prefix from the
+# testnets — `rpc1-mainnet.quantus.com`, where Planck has
+# `a1-planck.quantus.cat` — and its bootnodes (`a1..a7-p2p-mainnet.quantus.com`)
+# expose only port 30333, so they gossip and serve nothing. The official
+# explorer is no help either: it talks to a GraphQL indexer rather than to a
+# node.
+#
+# This buys availability, not depth. Failover moves on a transport failure, and
+# a node that has pruned answers `{"result": null}` — a success, so a deep read
+# stops at it rather than falling through to a peer that holds the state. #9.
+rpc_urls = [
+    "http://127.0.0.1:9944",
+    "https://rpc1-mainnet.quantus.com",
+    "https://rpc2-mainnet.quantus.com",
+]
+ws_urls = [
+    "ws://127.0.0.1:9944",
+    "wss://rpc1-mainnet.quantus.com",
+    "wss://rpc2-mainnet.quantus.com",
+]
 # TWELVE, not the 6.0 Planck used. `TARGET_BLOCK_TIME_MS` is 12_000 in the
 # runtime bob actually runs — verified at commit b017e642, which is the
 # `0.11.1-b017e6420aa` its `system_version` reports, not merely at the tip of