diff --git a/package-lock.json b/package-lock.json
index d52540595a..546921365b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9498,75 +9498,75 @@
       "integrity": "sha512-4zd4txmN7dYEx32kH/K+gecnZhnGDdCrRFK6/n5TGUtqtyjevw0uPul0knJ9PzwDXeNf9MsWzGhjxGeI1M43FA==",
       "dev": true,
       "requires": {
-        "@npmcli/arborist": "*",
-        "@npmcli/ci-detect": "*",
-        "@npmcli/config": "*",
-        "@npmcli/map-workspaces": "*",
-        "@npmcli/package-json": "*",
-        "@npmcli/run-script": "*",
-        "abbrev": "*",
-        "ansicolors": "*",
-        "ansistyles": "*",
-        "archy": "*",
-        "cacache": "*",
-        "chalk": "*",
-        "chownr": "*",
-        "cli-columns": "*",
-        "cli-table3": "*",
-        "columnify": "*",
-        "fastest-levenshtein": "*",
-        "glob": "*",
-        "graceful-fs": "*",
-        "hosted-git-info": "*",
-        "ini": "*",
-        "init-package-json": "*",
-        "is-cidr": "*",
-        "json-parse-even-better-errors": "*",
-        "libnpmaccess": "*",
-        "libnpmdiff": "*",
-        "libnpmexec": "*",
-        "libnpmfund": "*",
-        "libnpmhook": "*",
-        "libnpmorg": "*",
-        "libnpmpack": "*",
-        "libnpmpublish": "*",
-        "libnpmsearch": "*",
-        "libnpmteam": "*",
-        "libnpmversion": "*",
-        "make-fetch-happen": "*",
-        "minipass": "*",
-        "minipass-pipeline": "*",
-        "mkdirp": "*",
-        "mkdirp-infer-owner": "*",
-        "ms": "*",
-        "node-gyp": "*",
-        "nopt": "*",
-        "npm-audit-report": "*",
-        "npm-install-checks": "*",
-        "npm-package-arg": "*",
-        "npm-pick-manifest": "*",
-        "npm-profile": "*",
-        "npm-registry-fetch": "*",
-        "npm-user-validate": "*",
-        "npmlog": "*",
-        "opener": "*",
-        "pacote": "*",
-        "parse-conflict-json": "*",
-        "qrcode-terminal": "*",
-        "read": "*",
-        "read-package-json": "*",
-        "read-package-json-fast": "*",
-        "readdir-scoped-modules": "*",
-        "rimraf": "*",
-        "semver": "*",
-        "ssri": "*",
-        "tar": "*",
-        "text-table": "*",
-        "tiny-relative-date": "*",
-        "treeverse": "*",
-        "validate-npm-package-name": "*",
-        "which": "*",
-        "write-file-atomic": "*"
+        "@npmcli/arborist": "^2.8.3",
+        "@npmcli/ci-detect": "^1.2.0",
+        "@npmcli/config": "^2.3.0",
+        "@npmcli/map-workspaces": "^1.0.4",
+        "@npmcli/package-json": "^1.0.1",
+        "@npmcli/run-script": "^1.8.6",
+        "abbrev": "~1.1.1",
+        "ansicolors": "~0.3.2",
+        "ansistyles": "~0.1.3",
+        "archy": "~1.0.0",
+        "cacache": "^15.3.0",
+        "chalk": "^4.1.2",
+        "chownr": "^2.0.0",
+        "cli-columns": "^3.1.2",
+        "cli-table3": "^0.6.0",
+        "columnify": "~1.5.4",
+        "fastest-levenshtein": "^1.0.12",
+        "glob": "^7.1.7",
+        "graceful-fs": "^4.2.8",
+        "hosted-git-info": "^4.0.2",
+        "ini": "^2.0.0",
+        "init-package-json": "^2.0.5",
+        "is-cidr": "^4.0.2",
+        "json-parse-even-better-errors": "^2.3.1",
+        "libnpmaccess": "^4.0.2",
+        "libnpmdiff": "^2.0.4",
+        "libnpmexec": "^2.0.1",
+        "libnpmfund": "^1.1.0",
+        "libnpmhook": "^6.0.2",
+        "libnpmorg": "^2.0.2",
+        "libnpmpack": "^2.0.1",
+        "libnpmpublish": "^4.0.1",
+        "libnpmsearch": "^3.1.1",
+        "libnpmteam": "^2.0.3",
+        "libnpmversion": "^1.2.1",
+        "make-fetch-happen": "^9.1.0",
+        "minipass": "^3.1.3",
+        "minipass-pipeline": "^1.2.4",
+        "mkdirp": "^1.0.4",
+        "mkdirp-infer-owner": "^2.0.0",
+        "ms": "^2.1.2",
+        "node-gyp": "^7.1.2",
+        "nopt": "^5.0.0",
+        "npm-audit-report": "^2.1.5",
+        "npm-install-checks": "^4.0.0",
+        "npm-package-arg": "^8.1.5",
+        "npm-pick-manifest": "^6.1.1",
+        "npm-profile": "^5.0.3",
+        "npm-registry-fetch": "^11.0.0",
+        "npm-user-validate": "^1.0.1",
+        "npmlog": "^5.0.1",
+        "opener": "^1.5.2",
+        "pacote": "^11.3.5",
+        "parse-conflict-json": "^1.1.1",
+        "qrcode-terminal": "^0.12.0",
+        "read": "~1.0.7",
+        "read-package-json": "^4.1.1",
+        "read-package-json-fast": "^2.0.3",
+        "readdir-scoped-modules": "^1.1.0",
+        "rimraf": "^3.0.2",
+        "semver": "^7.3.5",
+        "ssri": "^8.0.1",
+        "tar": "^6.1.11",
+        "text-table": "~0.2.0",
+        "tiny-relative-date": "^1.3.0",
+        "treeverse": "^1.0.4",
+        "validate-npm-package-name": "~3.0.0",
+        "which": "^2.0.2",
+        "write-file-atomic": "^3.0.3"
       },
       "dependencies": {
         "@gar/promisify": {
diff --git a/src/constructs/acm/certificate.ts b/src/constructs/acm/certificate.ts
index 78ee5eac83..25f58183be 100644
--- a/src/constructs/acm/certificate.ts
+++ b/src/constructs/acm/certificate.ts
@@ -3,18 +3,13 @@ import type { CertificateProps } from "@aws-cdk/aws-certificatemanager/lib/certi
 import { HostedZone } from "@aws-cdk/aws-route53";
 import { RemovalPolicy } from "@aws-cdk/core";
 import { Stage } from "../../constants";
+import type { GuDomainNameProps } from "../../types/domain-names";
 import { GuStatefulMigratableConstruct } from "../../utils/mixin";
 import type { GuStack } from "../core";
 import { AppIdentity } from "../core/identity";
 import type { GuMigratingResource } from "../core/migrating";
 
-export type GuCertificateProps = Record<Stage, GuDnsValidatedCertificateProps> & GuMigratingResource;
-export type GuCertificatePropsWithApp = GuCertificateProps & AppIdentity;
-
-export interface GuDnsValidatedCertificateProps {
-  domainName: string;
-  hostedZoneId?: string;
-}
+export type GuCertificatePropsWithApp = GuDomainNameProps & AppIdentity;
 
 /**
  * Construct which creates a DNS-validated ACM Certificate.
diff --git a/src/patterns/__snapshots__/ec2-app.test.ts.snap b/src/patterns/__snapshots__/ec2-app.test.ts.snap
index 8a76618e08..8316c2437e 100644
--- a/src/patterns/__snapshots__/ec2-app.test.ts.snap
+++ b/src/patterns/__snapshots__/ec2-app.test.ts.snap
@@ -515,6 +515,33 @@ Object {
       },
       "Type": "AWS::ElasticLoadBalancingV2::Listener",
     },
+    "LoadBalancerCNameTestguec2app": Object {
+      "Properties": Object {
+        "Name": Object {
+          "Fn::FindInMap": Array [
+            "stagemapping",
+            Object {
+              "Ref": "Stage",
+            },
+            "domainName",
+          ],
+        },
+        "RecordType": "CNAME",
+        "ResourceRecords": Array [
+          Object {
+            "Fn::GetAtt": Array [
+              "LoadBalancerTestguec2appC77A055C",
+              "DNSName",
+            ],
+          },
+        ],
+        "Stage": Object {
+          "Ref": "Stage",
+        },
+        "TTL": 3600,
+      },
+      "Type": "Guardian::DNS::RecordSet",
+    },
     "LoadBalancerTestguec2appC77A055C": Object {
       "Properties": Object {
         "LoadBalancerAttributes": Array [
@@ -1352,6 +1379,33 @@ Object {
       },
       "Type": "AWS::ElasticLoadBalancingV2::Listener",
     },
+    "LoadBalancerCNameTestguec2app": Object {
+      "Properties": Object {
+        "Name": Object {
+          "Fn::FindInMap": Array [
+            "stagemapping",
+            Object {
+              "Ref": "Stage",
+            },
+            "domainName",
+          ],
+        },
+        "RecordType": "CNAME",
+        "ResourceRecords": Array [
+          Object {
+            "Fn::GetAtt": Array [
+              "LoadBalancerTestguec2appC77A055C",
+              "DNSName",
+            ],
+          },
+        ],
+        "Stage": Object {
+          "Ref": "Stage",
+        },
+        "TTL": 3600,
+      },
+      "Type": "Guardian::DNS::RecordSet",
+    },
     "LoadBalancerTestguec2appC77A055C": Object {
       "Properties": Object {
         "LoadBalancerAttributes": Array [
diff --git a/src/patterns/ec2-app.test.ts b/src/patterns/ec2-app.test.ts
index 039e2fb6cf..b6b6df3cb9 100644
--- a/src/patterns/ec2-app.test.ts
+++ b/src/patterns/ec2-app.test.ts
@@ -32,7 +32,7 @@ function simpleEc2AppForTesting(stack: GuStack, app: string, props: Partial<GuEc
     app: app,
     access: { scope: AccessScope.PUBLIC },
     instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-    certificateProps: {
+    domainNameProps: {
       [Stage.CODE]: { domainName: "code-guardian.com", hostedZoneId: "id123" },
       [Stage.PROD]: { domainName: "prod-guardian.com", hostedZoneId: "id124" },
     },
@@ -52,7 +52,7 @@ describe("the GuEC2App pattern", function () {
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
       monitoringConfiguration: { noMonitoring: true },
       userData: "#!/bin/dev foobarbaz",
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
     });
     expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
   });
@@ -66,7 +66,7 @@ describe("the GuEC2App pattern", function () {
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
       monitoringConfiguration: { noMonitoring: true },
       userData: "#!/bin/dev foobarbaz",
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
     });
     expect(SynthUtils.toCloudFormation(stack)).toMatchSnapshot();
   });
@@ -80,7 +80,7 @@ describe("the GuEC2App pattern", function () {
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
       monitoringConfiguration: { noMonitoring: true },
       userData: "#!/bin/dev foobarbaz",
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
     });
     expect(stack).toHaveResource("AWS::ElasticLoadBalancingV2::LoadBalancer", {
       Scheme: "internal",
@@ -98,7 +98,7 @@ describe("the GuEC2App pattern", function () {
       app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: {
         distributable: {
@@ -158,7 +158,7 @@ describe("the GuEC2App pattern", function () {
       app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: {
         snsTopicName: "test-topic",
         http5xxAlarm: {
@@ -180,7 +180,7 @@ describe("the GuEC2App pattern", function () {
       app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: {
         snsTopicName: "test-topic",
         http5xxAlarm: false,
@@ -200,7 +200,7 @@ describe("the GuEC2App pattern", function () {
       app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: {
         snsTopicName: "test-topic",
         http5xxAlarm: false,
@@ -220,7 +220,7 @@ describe("the GuEC2App pattern", function () {
       app: app,
       access: { scope: AccessScope.RESTRICTED, cidrRanges: [Peer.ipv4("192.168.1.1/32"), Peer.ipv4("8.8.8.8/32")] },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
     });
@@ -277,7 +277,7 @@ describe("the GuEC2App pattern", function () {
       app: app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
     });
@@ -305,7 +305,7 @@ describe("the GuEC2App pattern", function () {
           access: { scope: AccessScope.RESTRICTED, cidrRanges: [Peer.ipv4("0.0.0.0/0"), Peer.ipv4("1.2.3.4/32")] },
           app: app,
           instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-          certificateProps: getCertificateProps(),
+          domainNameProps: getCertificateProps(),
           monitoringConfiguration: { noMonitoring: true },
           userData: "",
         })
@@ -322,7 +322,7 @@ describe("the GuEC2App pattern", function () {
           access: { scope: AccessScope.INTERNAL, cidrRanges: [Peer.ipv4("93.1.2.3/12")] },
           app: app,
           instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-          certificateProps: getCertificateProps(),
+          domainNameProps: getCertificateProps(),
           monitoringConfiguration: { noMonitoring: true },
           userData: "",
         })
@@ -337,7 +337,7 @@ describe("the GuEC2App pattern", function () {
       access: { scope: AccessScope.PUBLIC },
       app: app,
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
       scaling: {
@@ -370,7 +370,7 @@ describe("the GuEC2App pattern", function () {
       access: { scope: AccessScope.PUBLIC },
       app: app,
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
       roleConfiguration: {
@@ -445,7 +445,7 @@ describe("the GuEC2App pattern", function () {
       app: app,
       access: { scope: AccessScope.RESTRICTED, cidrRanges: [] },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: {
+      domainNameProps: {
         [Stage.CODE]: { domainName: "code-guardian.com", hostedZoneId: "id123" },
         [Stage.PROD]: { domainName: "prod-guardian.com", hostedZoneId: "id124" },
       },
@@ -497,7 +497,7 @@ describe("the GuEC2App pattern", function () {
       app,
       access: { scope: AccessScope.PUBLIC },
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: {
+      domainNameProps: {
         [Stage.CODE]: { domainName: "code-guardian.com", hostedZoneId: "id123" },
         [Stage.PROD]: { domainName: "prod-guardian.com", hostedZoneId: "id124" },
       },
@@ -542,7 +542,7 @@ describe("the GuEC2App pattern", function () {
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
       monitoringConfiguration: { noMonitoring: true },
       userData: "#!/bin/dev foobarbaz",
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
     });
 
     new GuEc2App(stack, {
@@ -552,7 +552,7 @@ describe("the GuEC2App pattern", function () {
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
       monitoringConfiguration: { noMonitoring: true },
       userData: "#!/bin/dev foobarbaz",
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
     });
 
     expect(stack).toHaveGuTaggedResource("AWS::AutoScaling::AutoScalingGroup", {
@@ -582,7 +582,7 @@ describe("the GuEC2App pattern", function () {
       access: { scope: AccessScope.PUBLIC },
       app,
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
       accessLogging: { enabled: true, prefix: "access-logging-prefix" },
@@ -606,7 +606,7 @@ describe("the GuEC2App pattern", function () {
       access: { scope: AccessScope.PUBLIC },
       app,
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
       accessLogging: { enabled: false },
@@ -634,7 +634,7 @@ describe("the GuEC2App pattern", function () {
       access: { scope: AccessScope.PUBLIC },
       app,
       instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
-      certificateProps: getCertificateProps(),
+      domainNameProps: getCertificateProps(),
       monitoringConfiguration: { noMonitoring: true },
       userData: "",
       accessLogging: { enabled: false },
@@ -659,7 +659,7 @@ describe("the GuEC2App pattern", function () {
         instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
         monitoringConfiguration: { noMonitoring: true },
         userData: "#!/bin/dev foobarbaz",
-        certificateProps: {
+        domainNameProps: {
           [Stage.CODE]: {
             domainName: "code-guardian.com",
             hostedZoneId: "id123",
@@ -686,7 +686,7 @@ describe("the GuEC2App pattern", function () {
         instanceType: InstanceType.of(InstanceClass.T4G, InstanceSize.MEDIUM),
         monitoringConfiguration: { noMonitoring: true },
         userData: "#!/bin/dev foobarbaz",
-        certificateProps: {
+        domainNameProps: {
           [Stage.CODE]: {
             domainName: "code-guardian.com",
             hostedZoneId: "id123",
diff --git a/src/patterns/ec2-app.ts b/src/patterns/ec2-app.ts
index bc4e780a4e..099c5e434e 100644
--- a/src/patterns/ec2-app.ts
+++ b/src/patterns/ec2-app.ts
@@ -5,10 +5,9 @@ import { Port } from "@aws-cdk/aws-ec2";
 import { ApplicationProtocol } from "@aws-cdk/aws-elasticloadbalancingv2";
 import { Bucket } from "@aws-cdk/aws-s3";
 import { Duration, Tags } from "@aws-cdk/core";
-import type { Stage } from "../constants";
+import { Stage } from "../constants";
 import { SSM_PARAMETER_PATHS } from "../constants/ssm-parameter-paths";
 import { TagKeys } from "../constants/tag-keys";
-import type { GuCertificateProps } from "../constructs/acm";
 import { GuCertificate } from "../constructs/acm";
 import type { GuAsgCapacityProps, GuUserDataProps } from "../constructs/autoscaling";
 import { GuAutoScalingGroup, GuUserData } from "../constructs/autoscaling";
@@ -17,6 +16,7 @@ import { Gu5xxPercentageAlarm, GuUnhealthyInstancesAlarm } from "../constructs/c
 import type { GuStack } from "../constructs/core";
 import { GuStringParameter } from "../constructs/core";
 import { AppIdentity } from "../constructs/core/identity";
+import { GuCname } from "../constructs/dns";
 import { GuSecurityGroup, GuVpc, SubnetType } from "../constructs/ec2";
 import type { GuInstanceRoleProps } from "../constructs/iam";
 import { GuGetPrivateConfigPolicy, GuInstanceRole } from "../constructs/iam";
@@ -25,6 +25,7 @@ import {
   GuApplicationTargetGroup,
   GuHttpsApplicationListener,
 } from "../constructs/loadbalancing";
+import type { GuDomainNameProps } from "../types/domain-names";
 
 export enum AccessScope {
   PUBLIC = "Public",
@@ -170,7 +171,7 @@ export interface GuEc2AppProps extends AppIdentity {
   userData: GuUserDataProps | string;
   access: AppAccess;
   applicationPort: number;
-  certificateProps: GuCertificateProps;
+  domainNameProps: GuDomainNameProps;
   roleConfiguration?: GuInstanceRoleProps;
   monitoringConfiguration: Alarms | NoMonitoring;
   instanceType: InstanceType;
@@ -354,7 +355,7 @@ export class GuEc2App {
 
     const certificate = new GuCertificate(scope, {
       app,
-      ...props.certificateProps,
+      ...props.domainNameProps,
     });
 
     const maybePrivateConfigPolicy =
@@ -427,6 +428,19 @@ export class GuEc2App {
       );
     }
 
+    const domainName = scope.withStageDependentValue({
+      variableName: "domainName",
+      stageValues: {
+        [Stage.CODE]: props.domainNameProps.CODE.domainName,
+        [Stage.PROD]: props.domainNameProps.PROD.domainName,
+      },
+    });
+
+    new GuCname(scope, AppIdentity.suffixText(props, "LoadBalancerCName"), {
+      name: domainName,
+      resourceRecord: loadBalancer.loadBalancerDnsName,
+    });
+
     const targetGroup = new GuApplicationTargetGroup(scope, "TargetGroup", {
       app,
       vpc,
diff --git a/src/types/domain-names.ts b/src/types/domain-names.ts
new file mode 100644
index 0000000000..6bb6367911
--- /dev/null
+++ b/src/types/domain-names.ts
@@ -0,0 +1,9 @@
+import type { Stage } from "../constants";
+import type { GuMigratingResource } from "../constructs/core/migrating";
+
+export type GuDomainNameProps = Record<Stage, GuDomainName> & GuMigratingResource;
+
+export interface GuDomainName {
+  domainName: string;
+  hostedZoneId?: string;
+}