diff --git a/site-cookbooks/kosmos-hubot/recipes/nginx.rb b/site-cookbooks/kosmos-hubot/recipes/nginx.rb
index 0afc8ae..279ef16 100644
--- a/site-cookbooks/kosmos-hubot/recipes/nginx.rb
+++ b/site-cookbooks/kosmos-hubot/recipes/nginx.rb
@@ -6,8 +6,16 @@
 #
 
 node['kosmos-hubot']['vhosts'].each do |vhost|
-  domain        = vhost['domain']
-  upstream_host = search(:node, 'role:hubot').first['knife_zero']['host']
+  domain = vhost['domain']
+
+  # Restrict to the production environment and pick deterministically, so a
+  # stray node carrying role[hubot] (e.g. a retired one in _default) can't
+  # hijack the upstream.
+  upstream = search(:node, 'role:hubot AND chef_environment:production')
+             .sort_by(&:name).first
+  raise 'No production node with role[hubot] found for the hubot vhosts' unless upstream
+
+  upstream_host = upstream['knife_zero']['host']
 
   tls_cert_for domain do
     auth        'gandi_dns'