diff --git a/backend/src/services/remoteEnrollmentService.js b/backend/src/services/remoteEnrollmentService.js
index 020f368..d9aed7c 100644
--- a/backend/src/services/remoteEnrollmentService.js
+++ b/backend/src/services/remoteEnrollmentService.js
@@ -6,7 +6,7 @@ const { pathToFileURL } = require('url');
 const REPOSITORY_ROOT = path.resolve(__dirname, '../../..');
 const SETUP_MODULE_PATH = path.join(REPOSITORY_ROOT, 'scripts', 'setup-remote.mjs');
 const RESTART_MARKER_PATH = path.join(REPOSITORY_ROOT, '.remote-access', 'restart-requested.json');
-const DEFAULT_BOOTSTRAP_ENDPOINT = 'https://ck.yydd.ai/v1/enroll';
+const DEFAULT_BOOTSTRAP_ENDPOINT = 'https://ck.yydd.ai:8443/v1/enroll';
 
 function normalizeEndpoint(value) {
   const endpoint = new URL(String(value || DEFAULT_BOOTSTRAP_ENDPOINT).trim());
diff --git a/backend/test/remoteEnrollmentService.test.js b/backend/test/remoteEnrollmentService.test.js
index 1f527c9..563e961 100644
--- a/backend/test/remoteEnrollmentService.test.js
+++ b/backend/test/remoteEnrollmentService.test.js
@@ -8,7 +8,7 @@ const {
 
 test('remote enrollment defaults to the managed HTTPS endpoint', () => {
   assert.equal(normalizeEndpoint(''), DEFAULT_BOOTSTRAP_ENDPOINT);
-  assert.equal(normalizeEndpoint('https://ck.yydd.ai/v1/enroll'), 'https://ck.yydd.ai/v1/enroll');
+  assert.equal(normalizeEndpoint('https://ck.yydd.ai:8443/v1/enroll'), 'https://ck.yydd.ai:8443/v1/enroll');
 });
 
 test('remote enrollment refuses insecure or credential-bearing endpoints', () => {
diff --git a/frontend/src/pages/Install/index.jsx b/frontend/src/pages/Install/index.jsx
index ba8019c..30e6fce 100644
--- a/frontend/src/pages/Install/index.jsx
+++ b/frontend/src/pages/Install/index.jsx
@@ -332,7 +332,7 @@ const Install = () => {
             <Form
               form={remoteForm}
               layout="vertical"
-              initialValues={{ endpoint: 'https://ck.yydd.ai/v1/enroll' }}
+              initialValues={{ endpoint: 'https://ck.yydd.ai:8443/v1/enroll' }}
             >
               <Form.Item
                 label="数据库配置请求地址"
@@ -342,7 +342,7 @@ const Install = () => {
                   { type: 'url', message: '请输入有效的 HTTPS 地址' },
                 ]}
               >
-                <Input placeholder="https://ck.yydd.ai/v1/enroll" autoComplete="url" />
+                <Input placeholder="https://ck.yydd.ai:8443/v1/enroll" autoComplete="url" />
               </Form.Item>
               <Form.Item
                 label="API Key"
diff --git a/remote-access/README.md b/remote-access/README.md
index ecbecf2..9270146 100644
--- a/remote-access/README.md
+++ b/remote-access/README.md
@@ -12,7 +12,7 @@ npm --prefix frontend ci
 npm run remote:dev
 ```
 
-首次执行 `npm run remote:dev` 后，浏览器会显示首次启动弹窗。填写 `https://ck.yydd.ai/v1/enroll` 和管理员发放的部署 Key，然后点击“保存并获取配置”。Key 不会保存。成功后，数据库凭据写入被 Git 忽略的 `backend/.env`，SSH 私钥和证书写入 `.remote-access/`，文件权限仅限当前用户。
+首次执行 `npm run remote:dev` 后，浏览器会显示首次启动弹窗。填写 `https://ck.yydd.ai:8443/v1/enroll` 和管理员发放的部署 Key，然后点击“保存并获取配置”。Key 不会保存。成功后，数据库凭据写入被 Git 忽略的 `backend/.env`，SSH 私钥和证书写入 `.remote-access/`，文件权限仅限当前用户。
 
 注册服务会在中央系统数据库中创建一个独立管理员。弹窗只显示一次管理员账号和随机密码，开发者必须立即保存；服务端不保存可再次查看的密码明文。
 
@@ -37,7 +37,7 @@ npm run remote:start
 - 部署 Key 只用于设备注册，具有有效期和使用次数限制，不在仓库及本地配置中保存。
 - 每台设备获得独立数据库用户名和密码，可单独停用。账号只能访问 `cangku_system`，不能访问服务器的其他数据库或管理数据库用户。
 - SSH 证书只允许登录 `cangku-tunnel`，该账号不能打开终端，只能把本地端口转发至服务器的 `127.0.0.1:3307`。
-- SSH 主机密钥由注册服务固定下发并校验；注册接口使用 `ck.yydd.ai` 的公开可信 HTTPS 证书，证书由 systemd 定时任务自动续期。
+- SSH 主机密钥由注册服务固定下发并校验；注册接口使用 `ck.yydd.ai:8443` 的公开可信 HTTPS 证书，证书由 Certbot 定时任务自动续期。
 - 本地实例设置 `CLOUD_DB_RUNTIME_PROFILE=public`，从中央系统数据库读取已配置的第三方公网数据库连接。
 - 本地实例关闭后台同步任务，避免多台开发机重复执行定时同步。
 
diff --git a/remote-access/server/install.sh b/remote-access/server/install.sh
index 62be42a..89d4f5b 100644
--- a/remote-access/server/install.sh
+++ b/remote-access/server/install.sh
@@ -102,11 +102,11 @@ systemctl daemon-reload
 systemctl enable --now cangku-bootstrap
 systemctl enable --now certbot.timer
 ufw allow 80/tcp comment 'HTTP and ACME' >/dev/null
-ufw allow 443/tcp comment 'HTTPS' >/dev/null
+ufw allow 8443/tcp comment 'Cangku bootstrap HTTPS' >/dev/null
 systemctl reload nginx
 
 for _ in {1..20}; do
-  if curl --silent --show-error --fail https://ck.yydd.ai/health >/dev/null; then
+  if curl --silent --show-error --fail https://ck.yydd.ai:8443/health >/dev/null; then
     exit 0
   fi
   sleep 0.5
diff --git a/remote-access/server/nginx-bootstrap.conf b/remote-access/server/nginx-bootstrap.conf
index 9f4f35b..ff30898 100644
--- a/remote-access/server/nginx-bootstrap.conf
+++ b/remote-access/server/nginx-bootstrap.conf
@@ -1,22 +1,8 @@
 limit_req_zone $binary_remote_addr zone=cangku_bootstrap_limit:10m rate=5r/m;
 
 server {
-    listen 80;
-    listen [::]:80;
-    server_name ck.yydd.ai;
-
-    location /.well-known/acme-challenge/ {
-        root /var/www/cangku-bootstrap-acme;
-    }
-
-    location / {
-        return 301 https://ck.yydd.ai$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
+    listen 8443 ssl;
+    listen [::]:8443 ssl;
     server_name ck.yydd.ai;
 
     ssl_certificate /etc/letsencrypt/live/ck.yydd.ai/fullchain.pem;
@@ -40,7 +26,7 @@ server {
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Proto https;
         proxy_read_timeout 20s;
     }
 
diff --git a/scripts/setup-remote.mjs b/scripts/setup-remote.mjs
index d0dda25..4771392 100644
--- a/scripts/setup-remote.mjs
+++ b/scripts/setup-remote.mjs
@@ -16,7 +16,7 @@ import {
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
 const ROOT_DIR = path.resolve(SCRIPT_DIR, '..');
 const ACCESS_DIR = path.join(ROOT_DIR, '.remote-access');
-export const DEFAULT_ENDPOINT = 'https://ck.yydd.ai/v1/enroll';
+export const DEFAULT_ENDPOINT = 'https://ck.yydd.ai:8443/v1/enroll';
 const DEFAULT_LOCAL_DB_PORT = 13307;
 
 function parseArgs(args) {