diff --git a/DorkNet.Server/Data/images/image_BowlingAlley.png b/DorkNet.Server/Data/images/image_BowlingAlley.png
new file mode 100644
index 0000000..c29853f
Binary files /dev/null and b/DorkNet.Server/Data/images/image_BowlingAlley.png differ
diff --git a/DorkNet.Server/Data/images/image_PaintballKeyArt.png b/DorkNet.Server/Data/images/image_PaintballKeyArt.png
new file mode 100644
index 0000000..209753c
Binary files /dev/null and b/DorkNet.Server/Data/images/image_PaintballKeyArt.png differ
diff --git a/DorkNet.Server/site/src/lib/types.ts b/DorkNet.Server/site/src/lib/types.ts
index 64a562b..90c0c04 100644
--- a/DorkNet.Server/site/src/lib/types.ts
+++ b/DorkNet.Server/site/src/lib/types.ts
@@ -59,12 +59,23 @@ export interface SiteStats {
   inventionCount: number;
 }
 
-// CDN URL helper for profile images. Mirrors the admin SPA's helper
-// so the apex visit ends up calling img.localhost (signed via the
-// hardcoded p1 key id baked into the patched client). On rec.net
-// fallbacks to img.rec.net so the site works on either apex.
+// Resolve the image-CDN apex for the current host. The site is served
+// from the DorkNet apex (or www.apex) and the server exposes its
+// image-transform pipeline at img.{apex}, signed with the hardcoded p1
+// key id baked into the patched client. Derive the apex from the live
+// host so images load from THIS server's own CDN instead of leaking to
+// real Rec Room (img.rec.net) — which also drops the Azure affinity
+// cookies the browser was rejecting. Localhost dev → img.localhost.
+export function imageApex(): string {
+  if (typeof window === 'undefined') return 'localhost';
+  const host = window.location.host.split(':')[0];
+  if (host === 'localhost' || host.endsWith('.localhost')) return 'localhost';
+  return host.startsWith('www.') ? host.slice(4) : host;
+}
+
+// CDN URL helper for profile images, served from the server's own
+// img.{apex} (see imageApex).
 export function profileImageUrl(name: string | null | undefined, width = 96): string | null {
   if (!name) return null;
-  const apex = typeof window !== 'undefined' && window.location.host.endsWith('localhost') ? 'localhost' : 'rec.net';
-  return `https://img.${apex}/${encodeURIComponent(name)}?width=${width}&cropSquare=1&sig=p1`;
+  return `https://img.${imageApex()}/${encodeURIComponent(name)}?width=${width}&cropSquare=1&sig=p1`;
 }
diff --git a/DorkNet.Server/site/src/pages/Rooms.tsx b/DorkNet.Server/site/src/pages/Rooms.tsx
index 948f16c..1feccc1 100644
--- a/DorkNet.Server/site/src/pages/Rooms.tsx
+++ b/DorkNet.Server/site/src/pages/Rooms.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useMemo, useState } from 'react';
 import { get } from '../lib/api';
 import type { SiteRoom } from '../lib/types';
+import { imageApex } from '../lib/types';
 import { Empty } from '../components/Empty';
 import { num } from '../lib/format';
 
@@ -55,8 +56,7 @@ export function Rooms() {
 }
 
 function RoomCard({ room }: { room: SiteRoom }) {
-  const apex = typeof window !== 'undefined' && window.location.host.endsWith('localhost') ? 'localhost' : 'rec.net';
-  const img = room.imageName ? `https://img.${apex}/${encodeURIComponent(room.imageName)}?width=320&sig=p1` : null;
+  const img = room.imageName ? `https://img.${imageApex()}/${encodeURIComponent(room.imageName)}?width=320&sig=p1` : null;
   return (
     <div className="card overflow-hidden">
       <div className="aspect-[16/9] bg-ink-800 flex items-center justify-center">