diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 1274443..ea36006 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -161,7 +161,7 @@ Client -> nginx (443) -> /media/ location -> garage:3902
 runs envsubst at container start. Values come from `.env` generated by the
 `.env.keys` mechanism.
 
-**Bucket setup** (done by `new-app.sh` via admin API v2):
+**Bucket setup** (done by `app.sh` via admin API v2):
 1. `POST /v2/CreateBucket` with `globalAlias: <domain>`
 2. `POST /v2/AllowBucketKey` to grant media-key read/write access
 3. `POST /v2/UpdateBucket` to enable website access
diff --git a/CLAUDE.md b/CLAUDE.md
index 5f56469..f573d1d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -9,7 +9,6 @@ for technical deep-dives, USECASES.md for expected behaviors.
 - `scripts/configure.sh` -- Idempotent server config (firewall, certbot, start services; CI-safe)
 - `scripts/deploy.sh` -- SSH-triggered deploy + cert issuance + provision (deploy-*, cert-*, provision commands)
 - `tools/app.sh` -- App provisioning by subcommand (dns, repo, files, cert, garage, build, verify, all)
-- `tools/new-app.sh` -- Wrapper for `app.sh all` (backwards compat)
 - `tools/new-service.sh` -- Scaffold a new Docker Compose service (compose + workflow)
 - `tools/remove-app.sh` -- Remove a static site (local files + Gitea repo)
 - `docker/nginx/conf.d/` -- Per-app nginx server blocks
diff --git a/README.md b/README.md
index 03495d0..779aa12 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ scripts/
   configure.sh         # Idempotent server config (CI-safe)
   deploy.sh            # Deploy + provision (called via SSH)
 tools/
-  new-app.sh           # Add a new static site (run from dev machine)
+  app.sh               # Add a new static site (run from dev machine)
   new-service.sh       # Add a new Docker service (run from dev machine)
   remove-app.sh        # Remove a static site (run from dev machine)
 docker/
@@ -73,7 +73,7 @@ server. Everything is idempotent.
 ## Adding a new static site
 
 ```bash
-./tools/new-app.sh <domain>
+./tools/app.sh all <domain>
 ```
 
 This single command handles everything: DNS records (Vultr), Gitea repo
@@ -186,13 +186,13 @@ Project: `hantim`. Fetched via `bws` CLI on the server.
 |---|---|---|
 | `hantim-ci-registry-push` | Gitea token for Docker registry | `bootstrap.sh` |
 | `hantim-deploy-ssh-public-key` | Deploy user's SSH public key | `bootstrap.sh` |
-| `hantim-deploy-ssh-private-key` | Deploy user's SSH private key | `new-app.sh` |
-| `hantim-new-app-script` | Gitea API token for creating repos | `new-app.sh` |
-| `hantim-vultr-api-key` | Vultr API key for DNS management | `new-app.sh` |
+| `hantim-deploy-ssh-private-key` | Deploy user's SSH private key | `app.sh` |
+| `hantim-new-app-script` | Gitea API token for creating repos | `app.sh` |
+| `hantim-vultr-api-key` | Vultr API key for DNS management | `app.sh` |
 | `hantim-garage-rpc-secret` | Garage cluster RPC secret | `deploy.sh` |
 | `hantim-garage-argento-node-id` | Argento's Garage node ID + address | `deploy.sh` |
-| `hantim-garage-admin-token` | Garage admin API token | `deploy.sh`, `new-app.sh` |
-| `hantim-garage-media-key-id` | S3 access key ID for media uploads | `new-app.sh`, `aws` CLI |
+| `hantim-garage-admin-token` | Garage admin API token | `deploy.sh`, `app.sh` |
+| `hantim-garage-media-key-id` | S3 access key ID for media uploads | `app.sh`, `aws` CLI |
 | `hantim-garage-media-secret-key` | S3 secret key for media uploads | `aws` CLI |
 
 Machine accounts: `hantim-server` (token at `/etc/bws-token`), `hantim-ci` (reserved).
diff --git a/USECASES.md b/USECASES.md
index df2bbac..62c1884 100644
--- a/USECASES.md
+++ b/USECASES.md
@@ -38,7 +38,7 @@ for stateless static sites.
 
 ## 3. Add a new static site
 
-**Trigger:** `./tools/new-app.sh example.com` from dev machine.
+**Trigger:** `./tools/app.sh all example.com` from dev machine.
 
 **Prerequisites:** domain nameservers on Vultr, `bws`/`jq`/`dig` installed.
 
diff --git a/tools/new-app.sh b/tools/new-app.sh
deleted file mode 100755
index 271684c..0000000
--- a/tools/new-app.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Thin wrapper — delegates to app.sh all
-if [ -z "${1:-}" ]; then
-    echo "Usage: ./tools/new-app.sh <domain>"
-    echo "  Example: ./tools/new-app.sh example.com"
-    echo ""
-    echo "For individual steps, use: ./tools/app.sh <command> <domain>"
-    exit 1
-fi
-
-exec "$(dirname "$0")/app.sh" all "$1"