diff --git a/app.go b/app.go
index 5a1953962666155b508cbb66a9e0b61d27b501bb..8473e068fa6022a9feded700dce2ddfe13c93aec 100644
--- a/app.go
+++ b/app.go
@@ -12,10 +12,11 @@ import (
 	ghandlers "github.com/gorilla/handlers"
 	"github.com/rs/cors"
 	log "github.com/sirupsen/logrus"
+	"gitlab.com/lupine/go-mimedb"
+
 	"gitlab.com/gitlab-org/labkit/errortracking"
 	labmetrics "gitlab.com/gitlab-org/labkit/metrics"
 	"gitlab.com/gitlab-org/labkit/monitoring"
-	"gitlab.com/lupine/go-mimedb"
 
 	"gitlab.com/gitlab-org/gitlab-pages/internal/acme"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/artifact"
@@ -85,6 +86,12 @@ func (a *theApp) redirectToHTTPS(w http.ResponseWriter, r *http.Request, statusC
 
 func (a *theApp) getHostAndDomain(r *http.Request) (string, *domain.Domain, error) {
 	host := request.GetHostWithoutPort(r)
+
+	// do not try to serve files under -pages-domain
+	if a.Domain == host {
+		return host, nil, nil
+	}
+
 	domain, err := a.domain(host)
 
 	return host, domain, err
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index eaf3c25dd70a0ec3cd199b2216912e9b7406a056..04adbbb5ddb0eb0d8f19096ede4ee93933472b58 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -16,6 +16,7 @@ import (
 	"github.com/gorilla/securecookie"
 	"github.com/gorilla/sessions"
 	log "github.com/sirupsen/logrus"
+
 	"gitlab.com/gitlab-org/labkit/errortracking"
 
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httperrors"
diff --git a/internal/domain/domain.go b/internal/domain/domain.go
index deff2cc5c95e41b1b6ff222eca95acfff50a52bc..076dea0c94a12ffc14151f0c549d4bb2cfbe1938 100644
--- a/internal/domain/domain.go
+++ b/internal/domain/domain.go
@@ -5,15 +5,17 @@ import (
 	"crypto/tls"
 	"errors"
 	"net/http"
+	"strings"
 	"sync"
 
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httperrors"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/serving"
-	"gitlab.com/gitlab-org/gitlab-pages/internal/serving/disk/local"
 )
 
 // Domain is a domain that gitlab-pages can serve.
 type Domain struct {
+	servingRequest *serving.Request
+
 	Name            string
 	CertificateCert string
 	CertificateKey  string
@@ -38,16 +40,21 @@ func (d *Domain) isUnconfigured() bool {
 	return d.Resolver == nil
 }
 
-func (d *Domain) resolve(r *http.Request) *serving.Request {
-	request, _ := d.Resolver.Resolve(r)
+func (d *Domain) isSameProject(reqPath string) bool {
+	return d.servingRequest != nil &&
+		d.servingRequest.LookupPath != nil &&
+		strings.Contains(reqPath, d.servingRequest.LookupPath.Path)
+}
 
-	// TODO improve code around default serving, when `disk` serving gets removed
-	// https://gitlab.com/gitlab-org/gitlab-pages/issues/353
-	if request == nil {
-		return &serving.Request{Serving: local.Instance()}
+func (d *Domain) resolve(r *http.Request) *serving.Request {
+	if d.isSameProject(r.URL.Path) {
+		return d.servingRequest
 	}
 
-	return request
+	// store serving.Request to avoid calling d.Resolver.Resolve multiple times
+	d.servingRequest, _ = d.Resolver.Resolve(r)
+
+	return d.servingRequest
 }
 
 // GetLookupPath returns a project details based on the request. It returns nil
@@ -57,13 +64,7 @@ func (d *Domain) GetLookupPath(r *http.Request) *serving.LookupPath {
 		return nil
 	}
 
-	request := d.resolve(r)
-
-	if request == nil {
-		return nil
-	}
-
-	return request.LookupPath
+	return d.resolve(r).LookupPath
 }
 
 // IsHTTPSOnly figures out if the request should be handled with HTTPS
@@ -137,9 +138,7 @@ func (d *Domain) ServeFileHTTP(w http.ResponseWriter, r *http.Request) bool {
 		return true
 	}
 
-	request := d.resolve(r)
-
-	return request.ServeFileHTTP(w, r)
+	return d.resolve(r).ServeFileHTTP(w, r)
 }
 
 // ServeNotFoundHTTP serves the not found pages from the projects.
@@ -149,9 +148,7 @@ func (d *Domain) ServeNotFoundHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	request := d.resolve(r)
-
-	request.ServeNotFoundHTTP(w, r)
+	d.resolve(r).ServeNotFoundHTTP(w, r)
 }
 
 // serveNamespaceNotFound will try to find a parent namespace domain for a request