diff --git a/Dockerfile b/Dockerfile
index c3b0e25..ce98731 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # CI 中先 pnpm build 产出 dist/；运行时由 nginx 托管，并把 /embed /images /api/contact 反代到 A 站
 FROM nginx:1.27-alpine
 
-ENV A_UPSTREAM=http://project57-deploy.ns-project57.svc.cluster.local:3000
+ENV A_UPSTREAM=https://project57.website-build.org
 
 # 不走 templates/envsubst，避免把 nginx 的 $host/$uri 清空
 COPY nginx.conf /etc/nginx/conf.d/default.conf
diff --git a/README.md b/README.md
index ad73fcf..58bc797 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,13 @@ CI 对齐 project0：提交带 `[deploy]` 会构建镜像并部署。nginx 监
 
 仓库 Secrets：`LFS_PAT`、`KUBECONFIG_BASE64`。
 
-K8s 可设置环境变量覆盖 A 站地址（默认已按 CI 命名规则写好）：
+K8s 可设置环境变量覆盖 A 站地址（默认走 A 站公网域名，反代会带正确 Host/SNI）：
+
+```
+A_UPSTREAM=https://project57.website-build.org
+```
+
+若改回集群内 Service，例如：
 
 ```
 A_UPSTREAM=http://project57-deploy.ns-project57.svc.cluster.local:3000
diff --git a/docker-entrypoint.d/40-a-upstream.sh b/docker-entrypoint.d/40-a-upstream.sh
index 54ad1fa..26ca182 100644
--- a/docker-entrypoint.d/40-a-upstream.sh
+++ b/docker-entrypoint.d/40-a-upstream.sh
@@ -2,9 +2,16 @@
 set -eu
 
 CONF=/etc/nginx/conf.d/default.conf
-A_UPSTREAM="${A_UPSTREAM:-http://project57-deploy.ns-project57.svc.cluster.local:3000}"
+# A 站已有公网域名时走公网更稳；也可设为集群内 http://service.ns.svc:port
+A_UPSTREAM="${A_UPSTREAM:-https://project57.website-build.org}"
 A_UPSTREAM="${A_UPSTREAM%/}"
 
+# 从 URL 提取 Host，供反代 Host / SNI（Cloudflare/Ingress 依赖正确 Host）
+A_HOST="$(printf '%s' "${A_UPSTREAM}" | sed -E 's|^[a-zA-Z][a-zA-Z0-9+.-]*://||; s|[:/].*$||')"
+if [ -z "${A_HOST}" ]; then
+  A_HOST=project57.website-build.org
+fi
+
 NS="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf || true)"
 if [ -z "${NS}" ]; then
   NS=kube-dns.kube-system.svc.cluster.local
@@ -13,6 +20,8 @@ fi
 sed -i \
   -e "s|__RESOLVER__|${NS}|g" \
   -e "s|__A_UPSTREAM__|${A_UPSTREAM}|g" \
+  -e "s|__A_HOST__|${A_HOST}|g" \
   "${CONF}"
 
+echo "nginx upstream: ${A_UPSTREAM} (Host ${A_HOST}, resolver ${NS})"
 nginx -t
diff --git a/nginx.conf b/nginx.conf
index 09e38e4..0d61ea0 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -4,7 +4,7 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
-  # 由入口脚本写入：集群 DNS + A 站地址。用变量做 proxy_pass，启动时不解析上游，A 站暂不可达也不会让 nginx 起不来。
+  # 入口脚本写入集群 DNS；变量 proxy_pass 必须配合 resolver
   resolver __RESOLVER__ valid=10s ipv6=off;
 
   location = /api/health {
@@ -13,31 +13,38 @@ server {
     return 200 "ok";
   }
 
+  # 反代到 A 站（默认公网域名；也可改成集群内 Service）
   location /embed/ {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location /images/ {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location = /api/contact {
     set $a_upstream __A_UPSTREAM__;
-    proxy_pass $a_upstream;
+    proxy_pass $a_upstream$request_uri;
     proxy_http_version 1.1;
-    proxy_set_header Host $host;
+    proxy_ssl_server_name on;
+    proxy_set_header Host __A_HOST__;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Real-IP $remote_addr;
   }
 
   location / {