diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 357fd54b..d703227e 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -52,10 +52,11 @@ env:
   # unreachable; pinning CD to it blocks secret injection before GitOps deploy.
   K8S_SSH_HOST: 192.168.0.121
   K8S_API_SERVER: https://192.168.0.121:6443
-  # 2026-05-05 Codex: health/smoke probes use the keepalived VIP instead of a
-  # fixed node. Kubectl still tunnels through K8S_SSH_HOST.
-  API_HEALTH_URL: http://192.168.0.125:32334/api/v1/health
-  ALERT_CHAIN_API_URL: http://192.168.0.125:32334
+  # 2026-06-01 Codex: post-deploy health/smoke probes use the production
+  # public API. The old 192.168.0.125 NodePort VIP can be absent while the
+  # public route and in-cluster service are healthy, causing false failures.
+  API_HEALTH_URL: https://awoooi.wooo.work/api/v1/health
+  ALERT_CHAIN_API_URL: https://awoooi.wooo.work
 
 jobs:
   tests:
diff --git a/scripts/alert_chain_smoke_test.py b/scripts/alert_chain_smoke_test.py
index 1f7a988f..9af9c3b9 100644
--- a/scripts/alert_chain_smoke_test.py
+++ b/scripts/alert_chain_smoke_test.py
@@ -17,7 +17,7 @@ Wave A.6 (ADR-037): 驗證告警鏈路 E2E 完整性
 
 CI 整合 (cd.yaml):
   python3 scripts/alert_chain_smoke_test.py \
-    --api-url http://localhost:32334 \
+    --api-url https://awoooi.wooo.work \
     --fail-fast
 
 # Phase O-4.5 2026-04-02 (台北時間)
@@ -41,7 +41,7 @@ from urllib.request import Request, urlopen
 # =============================================================================
 # 配置
 # =============================================================================
-DEFAULT_API_URL = "http://192.168.0.125:32334"
+DEFAULT_API_URL = "https://awoooi.wooo.work"
 SIGNOZ_URL = "http://192.168.0.188:3301"
 ALERTMANAGER_URL = "http://192.168.0.188:9093"
 PROMETHEUS_URL = "http://192.168.0.110:9090"