diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 1338f75..760febd 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -8,9 +8,23 @@ http {
     sendfile on;
     keepalive_timeout 65;
 
-    upstream router_api { server router:9000; }
-    upstream dashboard_ui { server dashboard:3000; }
-    upstream litellm_backend { server litellm:4000; }
+    # Docker DNS resolver — forces request-time resolution for variable-based proxy_pass.
+    # Without this, nginx resolves upstream hostnames at config load time,
+    # which fails when Docker DNS (127.0.0.11) isn't ready yet on container start.
+    resolver 127.0.0.11 valid=30s;
+
+    # Dynamic upstream resolution via nginx variables.
+    # Using $var in proxy_pass forces request-time resolution through the resolver.
+    # Without this, 'host not found in upstream' crashes nginx when Docker DNS is slow.
+    map $host $router_api_url {
+        default http://harness-router:9000;
+    }
+    map $host $dashboard_ui_url {
+        default http://harness-dashboard:3000;
+    }
+    map $host $litellm_backend_url {
+        default http://harness-litellm:4000;
+    }
 
     # Detect Cloudflare Tunnel requests (cloudflared always sets CF-Connecting-IP).
     # Direct LAN browser access to :4000 has no such header -> redirect to canonical https,
@@ -40,7 +54,7 @@ http {
 
         # 2-Layer: /v1/ → router (existing keys work unchanged)
         location /v1/ {
-            proxy_pass http://router_api;
+            proxy_pass $router_api_url;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -52,7 +66,7 @@ http {
         }
 
         location @router_fallback {
-            proxy_pass http://router_api;
+            proxy_pass $router_api_url;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -61,7 +75,7 @@ http {
         }
 
         location /admin/ {
-            proxy_pass http://router_api;
+            proxy_pass $router_api_url;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -70,7 +84,7 @@ http {
         }
 
         location /stream {
-            proxy_pass http://router_api/stream;
+            proxy_pass $router_api_url/stream;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -80,14 +94,14 @@ http {
         }
 
         location /api/ {
-            proxy_pass http://router_api/;
+            proxy_pass $router_api_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         # LiteLLM gateway access (agents with new virtual keys)
         location /litellm/v1/ {
-            proxy_pass http://litellm_backend/v1/;
+            proxy_pass $litellm_backend_url/v1/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -99,14 +113,14 @@ http {
 
         # LiteLLM UI static assets
         location /litellm-asset-prefix/ {
-            proxy_pass http://litellm_backend/litellm-asset-prefix/;
+            proxy_pass $litellm_backend_url/litellm-asset-prefix/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         # LiteLLM Admin UI via /litellm/ prefix (LAN/internal access on :80)
         location /litellm/ {
-            proxy_pass http://litellm_backend/;
+            proxy_pass $litellm_backend_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -121,7 +135,7 @@ http {
         }
 
         location /dashboard/ {
-            proxy_pass http://dashboard_ui/;
+            proxy_pass $dashboard_ui_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
@@ -132,31 +146,31 @@ http {
         }
 
         location /metrics/ {
-            proxy_pass http://router_api/metrics/;
+            proxy_pass $router_api_url/metrics/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         location /metrics/circuit-breaker {
-            proxy_pass http://router_api/metrics/circuit-breaker;
+            proxy_pass $router_api_url/metrics/circuit-breaker;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         location /router/ {
-            proxy_pass http://router_api/;
+            proxy_pass $router_api_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         location /health/unified {
-            proxy_pass http://router_api/health/unified;
+            proxy_pass $router_api_url/health/unified;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
         location /health {
-            proxy_pass http://router_api/health;
+            proxy_pass $router_api_url/health;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
@@ -185,19 +199,19 @@ http {
 
         # LiteLLM Admin UI + WebSocket
         location /ui/ {
-            proxy_pass http://litellm_backend/ui/;
+            proxy_pass $litellm_backend_url/ui/;
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
             proxy_read_timeout 86400s;
             proxy_buffering off;
-            proxy_redirect http://litellm_backend/ https://litellm.sysloggh.net/;
+            proxy_redirect $litellm_backend_url/ https://litellm.sysloggh.net/;
             proxy_redirect http://litellm.sysloggh.net:4000/ https://litellm.sysloggh.net/;
         }
 
         # UI static assets
         location /litellm-asset-prefix/ {
-            proxy_pass http://litellm_backend/litellm-asset-prefix/;
+            proxy_pass $litellm_backend_url/litellm-asset-prefix/;
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
@@ -205,14 +219,14 @@ http {
 
         # SSO callback
         location /sso/ {
-            proxy_pass http://litellm_backend/sso/;
+            proxy_pass $litellm_backend_url/sso/;
             proxy_http_version 1.1;
             proxy_read_timeout 600s;
         }
 
         # API
         location /v1/ {
-            proxy_pass http://litellm_backend/v1/;
+            proxy_pass $litellm_backend_url/v1/;
             proxy_http_version 1.1;
             proxy_set_header Authorization $http_authorization;
             proxy_read_timeout 600s;
@@ -221,35 +235,35 @@ http {
 
         # Key management + admin API
         location /key/ {
-            proxy_pass http://litellm_backend/key/;
+            proxy_pass $litellm_backend_url/key/;
             proxy_http_version 1.1;
             proxy_set_header Authorization $http_authorization;
         }
         location /user/ {
-            proxy_pass http://litellm_backend/user/;
+            proxy_pass $litellm_backend_url/user/;
             proxy_http_version 1.1;
             proxy_set_header Authorization $http_authorization;
         }
         location /model/ {
-            proxy_pass http://litellm_backend/model/;
+            proxy_pass $litellm_backend_url/model/;
             proxy_http_version 1.1;
             proxy_set_header Authorization $http_authorization;
         }
         location /team/ {
-            proxy_pass http://litellm_backend/team/;
+            proxy_pass $litellm_backend_url/team/;
             proxy_http_version 1.1;
             proxy_set_header Authorization $http_authorization;
         }
 
         # Health
         location /health {
-            proxy_pass http://litellm_backend/health;
+            proxy_pass $litellm_backend_url/health;
             proxy_http_version 1.1;
         }
 
         # Root + everything else → LiteLLM (UI index, /configs, /spend, etc.)
         location / {
-            proxy_pass http://litellm_backend/;
+            proxy_pass $litellm_backend_url/;
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
diff --git a/nginx/nginx.conf.bak b/nginx/nginx.conf.bak
deleted file mode 100644
index da33ca2..0000000
--- a/nginx/nginx.conf.bak
+++ /dev/null
@@ -1,95 +0,0 @@
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events { worker_connections 1024; }
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" rt=$request_time';
-    access_log /var/log/nginx/access.log main;
-    error_log /var/log/nginx/error.log;
-    sendfile on;
-    keepalive_timeout 65;
-
-    upstream router_api { server router:9000; }
-    upstream dashboard_ui { server dashboard:3000; }
-    upstream litellm_backend { server litellm:4000; }
-
-    server {
-        listen 80;
-
-        # Security headers
-        add_header X-Content-Type-Options nosniff always;
-        add_header X-Frame-Options SAMEORIGIN always;
-        add_header X-XSS-Protection "1; mode=block" always;
-
-        # Disable buffering for SSE streams
-        proxy_buffering off;
-
-        # API — through router
-        location /v1/ {
-            proxy_pass http://router_api;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header Authorization $http_authorization;
-            proxy_connect_timeout 10s;
-            proxy_read_timeout 600s;
-            proxy_buffering off;
-        }
-
-        # SSE streaming endpoint
-        location /stream {
-            proxy_pass http://router_api;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header Connection "";
-            proxy_buffering off;
-            chunked_transfer_encoding off;
-        }
-
-        # Dashboard API proxy for SSE
-        location /api/ {
-            proxy_pass http://dashboard_ui;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_buffering off;
-        }
-
-        # LiteLLM debug
-        location /litellm/ {
-            rewrite ^/litellm/(.*) /$1 break;
-            proxy_pass http://litellm_backend;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header Authorization $http_authorization;
-        }
-
-        # Dashboard
-        location / {
-            proxy_pass http://dashboard_ui;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_buffering off;
-        }
-
-        # Performance analytics
-        location /metrics/ {
-            proxy_pass http://router_api;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-        }
-
-        location /health {
-            proxy_pass http://router_api/health;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-        }
-    }
-}