diff --git a/Jenkinsfile b/Jenkinsfile
index c25d2e9..c93894f 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -30,6 +30,7 @@ pipeline {
     string(name: 'NGINX_CONFIG_TARGET', defaultValue: '/etc/nginx/conf.d/nginx-admin.conf', description: 'Nginx 容器内 Admin 配置目标路径')
     string(name: 'NGINX_CONFIG_VOLUME_DIR', defaultValue: '/vol1/docker/kt-frontends/conf.d', description: 'Docker 宿主机上的 Nginx conf.d 挂载目录')
     string(name: 'NGINX_HELPER_IMAGE', defaultValue: 'nginx:1.27-alpine', description: '用于写入宿主机 Nginx 配置挂载目录的临时 helper 镜像')
+    string(name: 'NGINX_UPSTREAM_DOCKER_NETWORK', defaultValue: 'k3d-kt-nas', description: 'Nginx 访问 K8s NodePort upstream 所需的 Docker 网络')
     string(name: 'VITE_BASE', defaultValue: '/', description: '构建进 Admin 的 Vite base 路径')
     string(name: 'VITE_GLOB_API_URL', defaultValue: '/api', description: '构建进 Admin 的后端 API 前缀')
     choice(name: 'VITE_ROUTER_HISTORY', choices: ['hash', 'html5'], description: 'vue-router 模式')
@@ -94,6 +95,7 @@ pipeline {
             Deploy nginx config: ${params.DEPLOY_NGINX_CONFIG}
             Nginx container: ${params.NGINX_CONTAINER_NAME}
             Nginx config volume: ${params.NGINX_CONFIG_VOLUME_DIR}
+            Nginx upstream network: ${params.NGINX_UPSTREAM_DOCKER_NETWORK}
             API URL: ${params.VITE_GLOB_API_URL}
             Vite base: ${params.VITE_BASE}
             Router history: ${params.VITE_ROUTER_HISTORY}
@@ -213,6 +215,7 @@ pipeline {
           def configTarget = params.NGINX_CONFIG_TARGET?.trim()
           def configVolumeDir = params.NGINX_CONFIG_VOLUME_DIR?.trim()
           def helperImage = params.NGINX_HELPER_IMAGE?.trim()
+          def upstreamDockerNetwork = params.NGINX_UPSTREAM_DOCKER_NETWORK?.trim()
 
           if (!containerName || !configSource || !configTarget || !configVolumeDir || !helperImage) {
             error('NGINX_CONTAINER_NAME, NGINX_CONFIG_SOURCE, NGINX_CONFIG_TARGET, NGINX_CONFIG_VOLUME_DIR, and NGINX_HELPER_IMAGE are required when DEPLOY_NGINX_CONFIG is enabled.')
@@ -224,6 +227,7 @@ pipeline {
             "NGINX_CONFIG_TARGET=${configTarget}",
             "NGINX_CONFIG_VOLUME_DIR=${configVolumeDir}",
             "NGINX_HELPER_IMAGE=${helperImage}",
+            "NGINX_UPSTREAM_DOCKER_NETWORK=${upstreamDockerNetwork ?: ''}",
           ]) {
             runCmd("""
               set -e
@@ -259,6 +263,19 @@ pipeline {
 
               docker ps --format '{{.Names}}' | grep -Fx "\${NGINX_CONTAINER_NAME}" >/dev/null
 
+              if [ -n "\${NGINX_UPSTREAM_DOCKER_NETWORK}" ]; then
+                case "\${NGINX_UPSTREAM_DOCKER_NETWORK}" in
+                  *[!A-Za-z0-9_.-]*)
+                    echo "Unsafe NGINX_UPSTREAM_DOCKER_NETWORK: \${NGINX_UPSTREAM_DOCKER_NETWORK}"
+                    exit 1
+                    ;;
+                esac
+                docker network inspect "\${NGINX_UPSTREAM_DOCKER_NETWORK}" >/dev/null
+                if ! docker inspect "\${NGINX_CONTAINER_NAME}" --format '{{json .NetworkSettings.Networks}}' | grep -q "\\"\\${NGINX_UPSTREAM_DOCKER_NETWORK}\\""; then
+                  docker network connect "\${NGINX_UPSTREAM_DOCKER_NETWORK}" "\${NGINX_CONTAINER_NAME}"
+                fi
+              fi
+
               target_name=\$(basename "\${NGINX_CONFIG_TARGET}")
               backup_name="\${target_name}.bak-${env.BUILD_NUMBER}"
               docker image inspect "\${NGINX_HELPER_IMAGE}" >/dev/null 2>&1 || docker pull "\${NGINX_HELPER_IMAGE}"
diff --git a/apps/web-antdv-next/src/views/qqbot/account/napcat-boundary.spec.ts b/apps/web-antdv-next/src/views/qqbot/account/napcat-boundary.spec.ts
index e41099f..0056e9a 100644
--- a/apps/web-antdv-next/src/views/qqbot/account/napcat-boundary.spec.ts
+++ b/apps/web-antdv-next/src/views/qqbot/account/napcat-boundary.spec.ts
@@ -88,7 +88,7 @@ describe('qqbot account NapCat login view boundary', () => {
     expect(viteSource).toContain("'/napcat-webui'");
     expect(viteSource).toContain('http://localhost:48086');
     expect(nginxSource).toContain('location ^~ /napcat-webui/');
-    expect(nginxSource).toContain('48086');
+    expect(nginxSource).toContain('k3d-kt-nas-server-0:30086');
     expect(nginxSource).toContain('proxy_http_version 1.1');
     expect(nginxSource).toContain('location ^~ /kt-k8s-dashboard/');
   });
@@ -98,7 +98,11 @@ describe('qqbot account NapCat login view boundary', () => {
 
     expect(jenkinsSource).toContain("booleanParam(name: 'DEPLOY_NGINX_CONFIG'");
     expect(jenkinsSource).toContain("string(name: 'NGINX_CONFIG_VOLUME_DIR'");
+    expect(jenkinsSource).toContain(
+      "string(name: 'NGINX_UPSTREAM_DOCKER_NETWORK'",
+    );
     expect(jenkinsSource).toContain("stage('Deploy Nginx Config')");
+    expect(jenkinsSource).toContain('docker network connect');
     expect(jenkinsSource).toContain('docker run --rm -i');
     expect(jenkinsSource).toContain('NGINX_CONFIG_SOURCE');
     expect(jenkinsSource).toContain('nginx -t');
diff --git a/deploy/nginx-admin.conf b/deploy/nginx-admin.conf
index c42cbc6..ef45ebe 100644
--- a/deploy/nginx-admin.conf
+++ b/deploy/nginx-admin.conf
@@ -43,7 +43,7 @@ server {
   }
 
   location ^~ /napcat-webui/ {
-    proxy_pass http://192.168.31.224:48086/napcat-webui/;
+    proxy_pass http://k3d-kt-nas-server-0:30086/napcat-webui/;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection "upgrade";