diff --git a/nginx/conf.d/default.conf b/nginx/conf.d/default.conf
index 8e66427..24899e9 100644
--- a/nginx/conf.d/default.conf
+++ b/nginx/conf.d/default.conf
@@ -1,5 +1,13 @@
 limit_req_zone $binary_remote_addr zone=global_rate_limit:10m rate=50r/s;
 
+# Docker's embedded DNS (127.0.0.11) lets nginx re-resolve upstream service
+# hostnames. Without `resolver` + a variable-based proxy_pass, nginx resolves
+# `api` / `ui` to an IP once at startup and caches it forever — if the api
+# container is rebuilt and Docker gives it a new IP, nginx keeps hitting the
+# old one and every request returns 502 Bad Gateway until nginx is manually
+# restarted. `valid=10s` bounds the stale window to ~10 seconds.
+resolver 127.0.0.11 valid=10s ipv6=off;
+
 server {
   listen 80;
   server_name wowcheckout.such.software localhost;
@@ -11,7 +19,8 @@ server {
   }
 
   location /api/ {
-    proxy_pass http://api:8000/api/;
+    set $api_upstream "api";
+    proxy_pass http://$api_upstream:8000/api/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -23,7 +32,8 @@ server {
   }
 
   location = /openapi.json {
-    proxy_pass http://api:8000/openapi.json;
+    set $api_upstream "api";
+    proxy_pass http://$api_upstream:8000/openapi.json;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@@ -37,7 +47,8 @@ server {
   }
 
   location / {
-    proxy_pass http://ui:3000/;
+    set $ui_upstream "ui";
+    proxy_pass http://$ui_upstream:3000/;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;