diff --git a/nginx.conf b/nginx.conf
index c4554f7..bac771e 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -19,9 +19,16 @@ server {
   add_header Cross-Origin-Resource-Policy "same-origin" always;
   add_header X-Robots-Tag "noindex, nofollow" always;
 
+  # Use the cluster CoreDNS resolver so upstream hostnames are resolved
+  # lazily (per-request), not at nginx startup. The proxy_pass targets below
+  # use $variable form to force this lazy resolution; otherwise nginx fails
+  # to start when cluster DNS is briefly unavailable (e.g. node recovery).
+  resolver 10.43.0.10 valid=30s ipv6=off;
+
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
   location /api/ {
-    proxy_pass https://demo.flow-master.ai;
+    set $upstream_demo "https://demo.flow-master.ai";
+    proxy_pass $upstream_demo;
     proxy_set_header Host demo.flow-master.ai;
     proxy_set_header X-Forwarded-Proto https;
     proxy_set_header X-Forwarded-Host $host;
@@ -35,7 +42,8 @@ server {
   # In-cluster LLM proxy. Returns 503 when no provider key is configured,
   # so the frontend's deterministic fallback fires gracefully.
   location /internal/canvas-llm/ {
-    proxy_pass http://canvas-llm-proxy.demo.svc.cluster.local:8080;
+    set $upstream_llm "http://canvas-llm-proxy.demo.svc.cluster.local:8080";
+    proxy_pass $upstream_llm;
     proxy_set_header Host $host;
     proxy_set_header X-Forwarded-Proto https;
     proxy_http_version 1.1;