diff --git a/deploy/nginx/templates/contract-check-http.conf.template b/deploy/nginx/templates/contract-check-http.conf.template
index 50c542e..fb9b199 100644
--- a/deploy/nginx/templates/contract-check-http.conf.template
+++ b/deploy/nginx/templates/contract-check-http.conf.template
@@ -3,9 +3,11 @@
 # forwards to the api service. Same envsubst vars as the TLS template:
 # NGINX_SERVER_NAME (expanded by the nginx Docker entrypoint).
 
-upstream api {
-    server api:8000;
-}
+# Dynamic DNS resolution: when the API container is recreated it gets a new
+# IP. Using a variable with proxy_pass forces nginx to re-resolve `api`
+# against Docker's embedded DNS every `valid=` interval instead of caching the
+# address at startup.
+resolver 127.0.0.11 valid=10s;
 
 log_format contract_check '$remote_addr - $remote_user [$time_local] "$request" '
                             '$status $body_bytes_sent "$http_referer" '
@@ -27,7 +29,9 @@ server {
     server_name ${NGINX_SERVER_NAME} localhost;
 
     location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi.json) {
-        proxy_pass http://api;
+        # Variable forces dynamic DNS resolution for `api`.
+        set $api http://api:8000;
+        proxy_pass $api;
         proxy_http_version 1.1;
 
         proxy_set_header Host              $host;
@@ -44,7 +48,9 @@ server {
     }
 
     location /webhook/ {
-        proxy_pass http://api/api/v1/webhooks/;
+        # Variable forces dynamic DNS resolution for `api`.
+        set $api http://api:8000;
+        proxy_pass $api/api/v1/webhooks/;
         proxy_http_version 1.1;
 
         proxy_set_header Host              $host;
diff --git a/deploy/nginx/templates/contract-check.conf.template b/deploy/nginx/templates/contract-check.conf.template
index 896823d..1c4f15d 100644
--- a/deploy/nginx/templates/contract-check.conf.template
+++ b/deploy/nginx/templates/contract-check.conf.template
@@ -7,11 +7,17 @@
 # Do not run `nginx -t` directly on this .template file; render it first with
 # envsubst or start the container.
 
-# ── Upstreams ───────────────────────────────────────────────────────────────
-# In Docker Compose the `api` hostname resolves via the project network.
-upstream api {
-    server api:8000;
-}
+# ── Dynamic upstream resolution ─────────────────────────────────────────────
+# In Docker Compose the `api` hostname must be re-resolved when the API
+# container is recreated (it gets a new IP). By default nginx resolves an
+# upstream hostname once at startup and caches it forever, so after a deploy the
+# edge proxy would keep trying the old API IP. Using a variable with
+# proxy_pass forces nginx to re-resolve `api` against Docker's embedded DNS
+# every `valid=` interval.
+#
+# 127.0.0.11 is Docker's internal resolver (available inside containers).
+# If it is unreachable, increase `valid=` or set an explicit resolver address.
+resolver 127.0.0.11 valid=10s;
 
 # ── Logging ─────────────────────────────────────────────────────────────────
 log_format contract_check '$remote_addr - $remote_user [$time_local] "$request" '
@@ -65,7 +71,9 @@ server {
     # lock it down at the firewall (or remove this block if metrics must stay
     # private and are scraped by an in-compose Prometheus).
     location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi.json) {
-        proxy_pass http://api;
+        # Variable forces dynamic DNS resolution for `api`.
+        set $api http://api:8000;
+        proxy_pass $api;
         proxy_http_version 1.1;
 
         proxy_set_header Host              $host;
@@ -85,7 +93,9 @@ server {
     # Webhook endpoint for future payment providers (ЮKassa, etc.).
     # Kept separate so it's easy to add IP allow-listing or extra logging.
     location /webhook/ {
-        proxy_pass http://api/api/v1/webhooks/;
+        # Variable forces dynamic DNS resolution for `api`.
+        set $api http://api:8000;
+        proxy_pass $api/api/v1/webhooks/;
         proxy_http_version 1.1;
 
         proxy_set_header Host              $host;