diff --git a/apps/admin-panel/nginx.conf b/apps/admin-panel/nginx.conf
index ca82e48..26b716c 100644
--- a/apps/admin-panel/nginx.conf
+++ b/apps/admin-panel/nginx.conf
@@ -5,8 +5,14 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Docker's embedded DNS. Without re-resolving at request time, nginx caches the
+    # api container's IP from startup and keeps returning 502 ("no live upstreams")
+    # after the api container restarts with a new IP.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
     location /api/ {
-        proxy_pass http://api:3000;
+        set $api_upstream http://api:3000;
+        proxy_pass $api_upstream$request_uri;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/apps/api/release/app.js b/apps/api/release/app.js
index e8b0641..049b712 100644
--- a/apps/api/release/app.js
+++ b/apps/api/release/app.js
@@ -77633,7 +77633,7 @@ async function bootstrap() {
   app.useGlobalPipes(new common_1.ValidationPipe({ whitelist: true, transform: true }));
   app.useGlobalFilters(new prisma_exception_filter_1.PrismaExceptionFilter());
   app.enableCors();
-  await app.listen(process.env.PORT ?? 3e3);
+  await app.listen(process.env.PORT ?? 3e3, "0.0.0.0");
 }
 bootstrap();
 /*! Bundled license information:
diff --git a/apps/api/src/main.ts b/apps/api/src/main.ts
index bd1c143..9aaa04e 100644
--- a/apps/api/src/main.ts
+++ b/apps/api/src/main.ts
@@ -10,6 +10,7 @@ async function bootstrap() {
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
   app.useGlobalFilters(new PrismaExceptionFilter());
   app.enableCors();
-  await app.listen(process.env.PORT ?? 3000);
+  // Bind all interfaces explicitly so the container is reachable from nginx.
+  await app.listen(process.env.PORT ?? 3000, '0.0.0.0');
 }
 bootstrap();
diff --git a/apps/user-app/nginx.conf b/apps/user-app/nginx.conf
index ca82e48..26b716c 100644
--- a/apps/user-app/nginx.conf
+++ b/apps/user-app/nginx.conf
@@ -5,8 +5,14 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Docker's embedded DNS. Without re-resolving at request time, nginx caches the
+    # api container's IP from startup and keeps returning 502 ("no live upstreams")
+    # after the api container restarts with a new IP.
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
     location /api/ {
-        proxy_pass http://api:3000;
+        set $api_upstream http://api:3000;
+        proxy_pass $api_upstream$request_uri;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
diff --git a/docker-compose.yml b/docker-compose.yml
index d4bf565..06febb9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,14 +13,21 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql/data
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-goldbank}"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
 
   api:
     build:
       context: ./apps/api
       dockerfile: Dockerfile
     container_name: goldbank_api
+    # Prisma connects on module init, so a not-yet-ready DB crash-loops the API.
     depends_on:
-      - db
+      db:
+        condition: service_healthy
     environment:
       - DATABASE_URL=${DATABASE_URL:-postgresql://postgres:postgres@db:5432/goldbank?schema=public}
       - PORT=${PORT:-3000}