diff --git a/AGENTS.md b/AGENTS.md
index b334e8cc..25a0962a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -84,6 +84,7 @@
 - 当前服务器只有 2GB 内存，只负责运行容器、健康检查和镜像切换。
 - 严禁在服务器执行 `docker build`、`docker compose build`、`npm install`、`npm run production`、`composer install` 或其他源码构建命令。
 - `compose.jiangling.yml` 不得出现 `build:`；服务器只能运行开发机已经构建并上传的 `caiwu_akaunting:<commit>` 镜像。
+- 生产应用固定使用主机端口 `18088`，访问地址为 `http://118.196.84.79:18088`；端口、健康检查和 `APP_URL` 必须保持一致。
 - `mariadb:11.4` 运行镜像由开发机缓存并仅随首次初始化全量包上传，服务器不得在发布时临时访问 Docker Hub。
 - 日常发布必须通过只监听 `127.0.0.1` 的服务器本机 Registry 和 SSH 隧道传输，仅上传 Registry 中不存在的镜像层；禁止每次上传完整 `docker save` 压缩包。
 - 服务器保留当前镜像和上一个可回滚镜像，其他本项目旧镜像在发布成功后清理。
diff --git a/compose.jiangling.yml b/compose.jiangling.yml
index 7ea79511..f83a249a 100644
--- a/compose.jiangling.yml
+++ b/compose.jiangling.yml
@@ -27,7 +27,7 @@ services:
     environment:
       RUN_MIGRATIONS: ${RUN_MIGRATIONS:-0}
     ports:
-      - "80:18088"
+      - "18088:18088"
     volumes:
       - ./runtime/.env:/var/www/html/.env
       - caiwu_storage:/var/www/html/storage
diff --git a/deploy/activate-incremental-release.sh b/deploy/activate-incremental-release.sh
index 1dad4453..938fec2d 100644
--- a/deploy/activate-incremental-release.sh
+++ b/deploy/activate-incremental-release.sh
@@ -47,7 +47,7 @@ docker compose -f compose.jiangling.yml up -d --remove-orphans
 healthy=0
 attempt=1
 while [ "$attempt" -le 30 ]; do
-    if curl -fsS -o /dev/null http://127.0.0.1/; then
+    if curl -fsS -o /dev/null http://127.0.0.1:18088/; then
         healthy=1
         break
     fi
diff --git a/deploy/activate-release.sh b/deploy/activate-release.sh
index 2f28aac4..e2a62501 100644
--- a/deploy/activate-release.sh
+++ b/deploy/activate-release.sh
@@ -51,7 +51,7 @@ docker compose -f compose.jiangling.yml up -d --remove-orphans
 healthy=0
 attempt=1
 while [ "$attempt" -le 30 ]; do
-    if curl -fsS -o /dev/null http://127.0.0.1/; then
+    if curl -fsS -o /dev/null http://127.0.0.1:18088/; then
         healthy=1
         break
     fi
diff --git a/deploy/update-runtime-url.sh b/deploy/update-runtime-url.sh
new file mode 100644
index 00000000..4a0ad82b
--- /dev/null
+++ b/deploy/update-runtime-url.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+set -eu
+
+APP_URL="${1:?APP_URL is required}"
+REMOTE_DIR="${2:-/opt/caiwuxitong}"
+ENV_FILE="$REMOTE_DIR/runtime/.env"
+TEMP_FILE="$ENV_FILE.tmp"
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "update-runtime-url.sh must run as root" >&2
+    exit 1
+fi
+
+if [ ! -f "$ENV_FILE" ]; then
+    echo "Missing $ENV_FILE; run bootstrap-server.sh first" >&2
+    exit 1
+fi
+
+umask 077
+awk -v app_url="$APP_URL" '
+    BEGIN { updated = 0 }
+    /^APP_URL=/ {
+        print "APP_URL=" app_url
+        updated = 1
+        next
+    }
+    { print }
+    END {
+        if (!updated) {
+            print "APP_URL=" app_url
+        }
+    }
+' "$ENV_FILE" > "$TEMP_FILE"
+
+chown --reference="$ENV_FILE" "$TEMP_FILE"
+chmod --reference="$ENV_FILE" "$TEMP_FILE"
+mv "$TEMP_FILE" "$ENV_FILE"
diff --git a/docs/开发与部署SOP.md b/docs/开发与部署SOP.md
index 1fc189f2..623535c7 100644
--- a/docs/开发与部署SOP.md
+++ b/docs/开发与部署SOP.md
@@ -66,7 +66,7 @@
 - 创建持久化数据库卷和上传文件卷。
 - 上传应用与 MariaDB 首次全量包，并初始化仅限本机访问的增量 Registry。
 
-首次打开 `http://118.196.84.79` 后，由负责人或指定人员在网页安装向导中设置管理员账号和密码。
+首次打开 `http://118.196.84.79:18088` 后，由负责人或指定人员在网页安装向导中设置管理员账号和密码。
 
 ## 5. 日常正式发布
 
@@ -135,7 +135,7 @@ git pull --ff-only
 - 发布分支和完整 Git SHA；
 - 镜像标签；
 - 服务器 `caiwu_app`、`caiwu_db` 状态；
-- `http://118.196.84.79` 的实际返回结果；
+- `http://118.196.84.79:18088` 的实际返回结果；
 - 是否执行数据库迁移；
 - 本地临时包是否删除；
 - 本地/服务器保留了几个本项目镜像；
diff --git a/scripts/deploy-from-workstation.ps1 b/scripts/deploy-from-workstation.ps1
index 272c7b55..54b9d388 100644
--- a/scripts/deploy-from-workstation.ps1
+++ b/scripts/deploy-from-workstation.ps1
@@ -201,7 +201,7 @@ try {
     $buildDate = [DateTime]::UtcNow.ToString('yyyy-MM-ddTHH:mm:ssZ')
 
     if (-not $AppUrl) {
-        $AppUrl = "http://$Server"
+        $AppUrl = "http://${Server}:18088"
     }
 
     Invoke-Native { docker version | Out-Null } 'Docker Desktop 未启动或不可用。'
@@ -280,11 +280,16 @@ try {
             compose.jiangling.yml `
             deploy/activate-release.sh `
             deploy/activate-incremental-release.sh `
+            deploy/update-runtime-url.sh `
             deploy/setup-incremental-registry.sh `
             deploy/registry-config.yml `
             "${sshTarget}:$RemotePath/"
     } '上传运行配置失败。'
 
+    Invoke-Native {
+        ssh -i $keyFullPath -o BatchMode=yes $sshTarget "chmod 700 '$RemotePath/update-runtime-url.sh' && '$RemotePath/update-runtime-url.sh' '$AppUrl' '$RemotePath'"
+    } '更新服务器访问地址失败。'
+
     if ($BootstrapServer) {
         docker image inspect $DatabaseImage 2>$null | Out-Null
         if ($LASTEXITCODE -ne 0) {