diff --git a/_maintenance_update_graph_data.sh.example b/_maintenance_update_graph_data.sh.example
index 11609d45c9..c425cd410b 100644
--- a/_maintenance_update_graph_data.sh.example
+++ b/_maintenance_update_graph_data.sh.example
@@ -2,9 +2,9 @@
 
 set -eu
 
-outFile="$(dirname "$0")/js/cert-timeline.tsv"
+outFile="$(dirname "$0")/js/cert-daily-stats.tsv"
 
 # Download to a temp file, then move over-top the original, so that the update is
 # atomic from the perspective of the webserver
-curl --silent https://ct.tacticalsecret.com/cert-timeline.tsv > "${outFile}.bak"
+curl --silent https://ct.tacticalsecret.com/cert-daily-stats.tsv > "${outFile}.bak"
 mv "${outFile}.bak" "${outFile}"
diff --git a/config/_default/server.toml b/config/_default/server.toml
index a7107ba970..1f7a6d0af0 100644
--- a/config/_default/server.toml
+++ b/config/_default/server.toml
@@ -18,7 +18,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/" for stats graphs
+# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -79,6 +79,7 @@ Content-Security-Policy = """
     ;
     connect-src 'self'
         https://d4twhgtvn0ff5.cloudfront.net/
+        https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com
         https://letsencrypt-merch.myshopify.com
diff --git a/netlify.toml b/netlify.toml
index a7a71164bf..45a4e6fe04 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -28,7 +28,7 @@ Permissions-Policy = """
     fullscreen=(self),
     interest-cohort=()
 """
-# "connect-src https://d4twhgtvn0ff5.cloudfront.net/" for stats graphs
+# "connect-src https://d4twhgtvn0ff5.cloudfront.net/ and https://d1dfn7jg27m4cf.cloudfront.net/" for stats graphs
 # "img-src data: blob:" is for Plotly download feature
 # "script-src unsafe-eval unsafe-inline data:": For Google Analytics
 # "form-action" is NOT set, so it allows everything (it doesn't default to default-src). If restricted, It must allow at least www.paypal.com and its redirects
@@ -89,6 +89,7 @@ Content-Security-Policy = """
     ;
     connect-src 'self'
         https://d4twhgtvn0ff5.cloudfront.net/
+        https://d1dfn7jg27m4cf.cloudfront.net/
         https://donorbox.org
         https://doublethedonation.com
         https://letsencrypt-merch.myshopify.com
diff --git a/static/js/cert-timeline.tsv b/static/js/cert-daily-stats.tsv
similarity index 99%
rename from static/js/cert-timeline.tsv
rename to static/js/cert-daily-stats.tsv
index d6c782c3fa..03ea9b24c3 100644
--- a/static/js/cert-timeline.tsv
+++ b/static/js/cert-daily-stats.tsv
@@ -1,3 +1,4 @@
+date	certs_issued	certs_active	fqdns_active	reg_domains_active
 2015-10-08	2	2	1	1
 2015-10-09	4	6	5	2
 2015-10-10	1	7	6	2
diff --git a/static/js/stats.js b/static/js/stats.js
index 73096952cf..e8d4993bd4 100644
--- a/static/js/stats.js
+++ b/static/js/stats.js
@@ -319,13 +319,20 @@ function doPlot() {
   }
 
   var path;
-  if ( location.hostname === "letsencrypt.org" ) {
+  if ( location.hostname === "localhost" ) {
+    path = "/js/"; // in dev, will use old data.
+  } else {
     path = "https://d4twhgtvn0ff5.cloudfront.net/";
+  }
+
+  var statsPath;
+  if ( location.hostname === "localhost" ) {
+    statsPath = "/js/"; // in dev, will use old data.
   } else {
-    path = "/js/"; // in dev, will use old data.
+    statsPath = "https://d1dfn7jg27m4cf.cloudfront.net/";
   }
 
-  fetch(path+"cert-timeline.tsv")
+  fetch(statsPath+"cert-daily-stats.tsv")
   .then(response => {
     return response.text();
   }).then(tsvListener);