diff --git a/registry/coder/modules/goose/README.md b/registry/coder/modules/goose/README.md
index cdc63c3f6..a1dbfefec 100644
--- a/registry/coder/modules/goose/README.md
+++ b/registry/coder/modules/goose/README.md
@@ -13,7 +13,7 @@ Run the [Goose](https://block.github.io/goose/) agent in your workspace to gener
 ```tf
 module "goose" {
   source           = "registry.coder.com/coder/goose/coder"
-  version          = "2.1.1"
+  version          = "2.1.2"
   agent_id         = coder_agent.example.id
   folder           = "/home/coder"
   install_goose    = true
@@ -79,7 +79,7 @@ resource "coder_agent" "main" {
 module "goose" {
   count            = data.coder_workspace.me.start_count
   source           = "registry.coder.com/coder/goose/coder"
-  version          = "2.1.1"
+  version          = "2.1.2"
   agent_id         = coder_agent.example.id
   folder           = "/home/coder"
   install_goose    = true
@@ -123,4 +123,6 @@ Note: The indentation in the heredoc is preserved, so you can write the YAML nat
 
 ## Troubleshooting
 
+By default, this module is configured to run the embedded chat interface as a path-based application. In production, we recommend that you configure a [wildcard access URL](https://coder.com/docs/admin/setup#wildcard-access-url) and set `subdomain = true`. See [here](https://coder.com/docs/tutorials/best-practices/security-best-practices#disable-path-based-apps) for more details.
+
 The module will create log files in the workspace's `~/.goose-module` directory. If you run into any issues, look at them for more information.
diff --git a/registry/coder/modules/goose/main.test.ts b/registry/coder/modules/goose/main.test.ts
index 9dd4dc796..ae5635b00 100644
--- a/registry/coder/modules/goose/main.test.ts
+++ b/registry/coder/modules/goose/main.test.ts
@@ -2,6 +2,7 @@ import {
   test,
   afterEach,
   describe,
+  it,
   setDefaultTimeout,
   beforeAll,
   expect,
@@ -253,22 +254,41 @@ describe("goose", async () => {
     expect(prompt.stderr).toContain("No such file or directory");
   });
 
-  test("subdomain-false", async () => {
-    const { id } = await setup({
-      agentapiMockScript: await loadTestFile(
-        import.meta.dir,
-        "agentapi-mock-print-args.js",
-      ),
-      moduleVariables: {
-        subdomain: "false",
-      },
+  describe("subdomain", async () => {
+    it("sets AGENTAPI_CHAT_BASE_PATH when false", async () => {
+      const { id } = await setup({
+        agentapiMockScript: await loadTestFile(
+          import.meta.dir,
+          "agentapi-mock-print-args.js",
+        ),
+        moduleVariables: {
+          subdomain: "false",
+        },
+      });
+
+      await execModuleScript(id);
+
+      const agentapiMockOutput = await readFileContainer(id, agentapiStartLog);
+      expect(agentapiMockOutput).toContain(
+        "AGENTAPI_CHAT_BASE_PATH=/@default/default.foo/apps/goose/chat",
+      );
     });
 
-    await execModuleScript(id);
+    it("does not set AGENTAPI_CHAT_BASE_PATH when true", async () => {
+      const { id } = await setup({
+        agentapiMockScript: await loadTestFile(
+          import.meta.dir,
+          "agentapi-mock-print-args.js",
+        ),
+        moduleVariables: {
+          subdomain: "true",
+        },
+      });
 
-    const agentapiMockOutput = await readFileContainer(id, agentapiStartLog);
-    expect(agentapiMockOutput).toContain(
-      "AGENTAPI_CHAT_BASE_PATH=/@default/default.foo/apps/goose/chat",
-    );
+      await execModuleScript(id);
+
+      const agentapiMockOutput = await readFileContainer(id, agentapiStartLog);
+      expect(agentapiMockOutput).toMatch(/AGENTAPI_CHAT_BASE_PATH=$/m);
+    });
   });
 });
diff --git a/registry/coder/modules/goose/main.tf b/registry/coder/modules/goose/main.tf
index 69f93aa37..2e015e765 100644
--- a/registry/coder/modules/goose/main.tf
+++ b/registry/coder/modules/goose/main.tf
@@ -69,7 +69,7 @@ variable "agentapi_version" {
 variable "subdomain" {
   type        = bool
   description = "Whether to use a subdomain for AgentAPI."
-  default     = true
+  default     = false
 }
 
 variable "goose_provider" {