diff --git a/nginx.conf b/nginx.conf
index 05c9689..6614f6e 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -19,23 +19,22 @@ server {
   add_header Cross-Origin-Resource-Policy "same-origin" always;
   add_header X-Robots-Tag "noindex, nofollow" always;
 
-  # Use the cluster CoreDNS resolver for in-cluster Services AND public
-  # resolvers as fallback for external hostnames (demo.flow-master.ai etc.).
-  # k3s CoreDNS by default forwards external lookups, but if the forward
-  # is missing the proxy_pass to demo.flow-master.ai fails with 502/504.
-  # Listing public resolvers alongside ensures lookups succeed in both
-  # cases. Targets use $variable form to force lazy per-request resolution.
-  resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
+  # Use PUBLIC DNS resolvers exclusively for upstream resolution. The
+  # k3s CoreDNS at 10.43.0.10 returns SERVFAIL for external hostnames
+  # like demo.flow-master.ai in this environment, which previously
+  # caused intermittent 502s when nginx queried CoreDNS first. Pinning
+  # to Cloudflare + Google means demo.flow-master.ai resolves the same
+  # way it does from the public internet.
+  resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
 
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
-  # NOTE: proxy_pass uses a literal hostname (not a $variable) so nginx
-  # resolves demo.flow-master.ai ONCE at config-load, caches it for the
-  # lifetime of the worker, and never retries DNS mid-request. This is
-  # the only way to eliminate the per-request DNS race that returned
-  # fast 502s on cold cache. Cloudflare hides the demo origin behind
-  # anycast IPs, so a single-resolution lookup is safe and stable.
+  # Uses $variable form so nginx queries the PUBLIC resolver above per
+  # request (cached 5 minutes). Combined with proxy_next_upstream this
+  # tolerates a transient upstream failure with a single client-visible
+  # latency penalty.
   location /api/ {
-    proxy_pass https://demo.flow-master.ai;
+    set $upstream_demo "https://demo.flow-master.ai";
+    proxy_pass $upstream_demo;
     proxy_set_header Host demo.flow-master.ai;
     proxy_set_header X-Forwarded-Proto https;
     proxy_set_header X-Forwarded-Host $host;