diff --git a/app/api/meetup/complete-order/route.ts b/app/api/meetup/complete-order/route.ts
index a255a48..d52d35d 100644
--- a/app/api/meetup/complete-order/route.ts
+++ b/app/api/meetup/complete-order/route.ts
@@ -39,7 +39,6 @@ async function verifyOrderPaid(request: NextRequest, orderId: string): Promise<b
     request.headers.get("host") || request.headers.get("x-forwarded-host");
   const apiUrl = (
     getApiUrlFromRequest(hostHeader) ||
-    process.env.PAYMENT_API_URL ||
     config.apiUrl
   ).replace(/\/$/, "");
 
diff --git a/app/api/pay/route.ts b/app/api/pay/route.ts
index 809c7eb..de7209c 100644
--- a/app/api/pay/route.ts
+++ b/app/api/pay/route.ts
@@ -13,11 +13,7 @@ function resolvePayApiUrl(request: NextRequest): string {
   const config = getPaymentConfig();
   const hostHeader =
     request.headers.get("host") || request.headers.get("x-forwarded-host");
-  return (
-    getApiUrlFromRequest(hostHeader) ||
-    process.env.PAYMENT_API_URL ||
-    config.apiUrl
-  ).replace(/\/$/, "");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
 }
 
 function setPayOrderCookie(response: NextResponse, orderId: string) {
diff --git a/app/api/pay/status/route.ts b/app/api/pay/status/route.ts
index c1e4569..fbe7d13 100644
--- a/app/api/pay/status/route.ts
+++ b/app/api/pay/status/route.ts
@@ -10,11 +10,7 @@ function resolvePayApiUrl(request: NextRequest): string {
   const config = getPaymentConfig();
   const hostHeader =
     request.headers.get("host") || request.headers.get("x-forwarded-host");
-  return (
-    getApiUrlFromRequest(hostHeader) ||
-    process.env.PAYMENT_API_URL ||
-    config.apiUrl
-  ).replace(/\/$/, "");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
 }
 
 export async function GET(request: NextRequest) {
diff --git a/config/domain.config.ts b/config/domain.config.ts
index 98a1943..db7b53b 100644
--- a/config/domain.config.ts
+++ b/config/domain.config.ts
@@ -8,11 +8,20 @@ const isDev = process.env.NODE_ENV === "development";
 export const ROOT_DOMAIN =
   process.env.ROOT_DOMAIN || process.env.NEXT_PUBLIC_ROOT_DOMAIN || "hackrobot.cn";
 
-/** 支付 API 默认地址（本地可用 PAYMENT_API_URL 覆盖） */
+/** 支付 API 默认地址。生产环境固定为 api 域名，避免 .env 中 127.0.0.1 导致支付失败 */
 export const DEFAULT_PAYMENT_API_URL = isDev
   ? "http://127.0.0.1:8007"
   : `https://api.${ROOT_DOMAIN}`;
 
+/** 生产环境若 PAYMENT_API_URL 指向 localhost，则忽略并使用 api 域名 */
+export function resolvePaymentApiUrl(): string {
+  const url = process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL;
+  if (!isDev && /^(https?:\/\/)?(127\.0\.0\.1|localhost)(:\d+)?(\/|$)/i.test(url)) {
+    return `https://api.${ROOT_DOMAIN}`;
+  }
+  return url;
+}
+
 export const DEFAULT_POCKETBASE_URL = `https://pocketbase.${ROOT_DOMAIN}`;
 
 export const DEFAULT_MINIO_HOST = `minioweb.${ROOT_DOMAIN}`;
diff --git a/config/services.config.ts b/config/services.config.ts
index 2cb3d1d..8268d16 100644
--- a/config/services.config.ts
+++ b/config/services.config.ts
@@ -7,6 +7,7 @@ import {
   DEFAULT_PAYMENT_API_URL,
   DEFAULT_POCKETBASE_URL,
   DEFAULT_MINIO_HOST,
+  resolvePaymentApiUrl,
 } from "./domain.config";
 
 export interface PocketBaseConfig {
@@ -49,7 +50,7 @@ export const MEETUP_JOIN_AMOUNT = 8800;
 
 export function getApiUrlFromRequest(hostHeader: string | null): string | null {
   if (!hostHeader) return null;
-  if (!isDev) return process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL;
+  if (!isDev) return resolvePaymentApiUrl();
   const hostname = hostHeader.split(":")[0];
   return `http://${hostname}:${PAYJSAPI_PORT}`;
 }
@@ -69,7 +70,7 @@ export function getPocketBaseConfig(): PocketBaseConfig {
 export function getPaymentConfig(): PaymentConfig {
   return {
     enabled: true,
-    apiUrl: process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL,
+    apiUrl: resolvePaymentApiUrl(),
     provider: (process.env.PAYMENT_PROVIDER as "zpay" | "xorpay") || "zpay",
     defaultAmount: Number(process.env.PAYMENT_DEFAULT_AMOUNT) || 8800,
     defaultType: process.env.PAYMENT_DEFAULT_TYPE || "meetup",