diff --git a/app/api/pay/confirm/route.ts b/app/api/pay/confirm/route.ts
index b383f52..6ed2656 100644
--- a/app/api/pay/confirm/route.ts
+++ b/app/api/pay/confirm/route.ts
@@ -49,7 +49,6 @@ function resolvePayApiUrl(request: NextRequest): string {
   const hostHeader = request.headers.get("host") || request.headers.get("x-forwarded-host");
   return (
     (hostHeader ? getApiUrlFromRequest(hostHeader) : null) ||
-    process.env.PAYMENT_API_URL ||
     payConfig.apiUrl
   ).replace(/\/$/, "");
 }
diff --git a/app/api/pay/route.ts b/app/api/pay/route.ts
index 0fb638a..4fff199 100644
--- a/app/api/pay/route.ts
+++ b/app/api/pay/route.ts
@@ -13,11 +13,7 @@ function resolvePayApiUrl(request: NextRequest): string {
   const config = getPaymentConfig();
   const hostHeader =
     request.headers.get("host") || request.headers.get("x-forwarded-host");
-  return (
-    getApiUrlFromRequest(hostHeader) ||
-    process.env.PAYMENT_API_URL ||
-    config.apiUrl
-  ).replace(/\/$/, "");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
 }
 
 function setPayOrderCookie(response: NextResponse, orderId: string) {
diff --git a/app/api/pay/status/route.ts b/app/api/pay/status/route.ts
index 77449e9..751d848 100644
--- a/app/api/pay/status/route.ts
+++ b/app/api/pay/status/route.ts
@@ -10,11 +10,7 @@ function resolvePayApiUrl(request: NextRequest): string {
   const config = getPaymentConfig();
   const hostHeader =
     request.headers.get("host") || request.headers.get("x-forwarded-host");
-  return (
-    getApiUrlFromRequest(hostHeader) ||
-    process.env.PAYMENT_API_URL ||
-    config.apiUrl
-  ).replace(/\/$/, "");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
 }
 
 export async function GET(request: NextRequest) {
diff --git a/config/domain.config.ts b/config/domain.config.ts
index 6c3a771..2ebebdc 100644
--- a/config/domain.config.ts
+++ b/config/domain.config.ts
@@ -16,11 +16,20 @@ const isDev = process.env.NODE_ENV === "development";
 export const ROOT_DOMAIN =
   process.env.ROOT_DOMAIN || process.env.NEXT_PUBLIC_ROOT_DOMAIN || "hackrobot.cn";
 
-/** 支付 API 默认地址（本地可用 PAYMENT_API_URL 覆盖，如 http://192.168.41.222:8007） */
+/** 支付 API 默认地址。生产环境固定为 api.${ROOT_DOMAIN}，避免 .env 中 127.0.0.1 导致支付失败 */
 export const DEFAULT_PAYMENT_API_URL = isDev
   ? "http://127.0.0.1:8007"
   : `https://api.${ROOT_DOMAIN}`;
 
+/** 生产环境若 PAYMENT_API_URL 指向 localhost，则忽略并使用 api 域名 */
+export function resolvePaymentApiUrl(): string {
+  const url = process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL;
+  if (!isDev && /^(https?:\/\/)?(127\.0\.0\.1|localhost)(:\d+)?(\/|$)/i.test(url)) {
+    return `https://api.${ROOT_DOMAIN}`;
+  }
+  return url;
+}
+
 /** PocketBase 默认地址 */
 export const DEFAULT_POCKETBASE_URL = `https://pocketbase.${ROOT_DOMAIN}`;
 
diff --git a/config/services.config.ts b/config/services.config.ts
index d92696b..d537688 100644
--- a/config/services.config.ts
+++ b/config/services.config.ts
@@ -7,6 +7,7 @@
 import { getThemeConfig } from "./site.config";
 import {
   DEFAULT_PAYMENT_API_URL,
+  resolvePaymentApiUrl,
   DEFAULT_POCKETBASE_URL,
   DEFAULT_MINIO_HOST,
 } from "./domain.config";
@@ -74,7 +75,7 @@ export const VIP_MASTER_SITE_ID = "vip";
 
 export function getApiUrlFromRequest(hostHeader: string | null): string | null {
   if (!hostHeader) return null;
-  if (!isDev) return process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL;
+  if (!isDev) return resolvePaymentApiUrl();
   const hostname = hostHeader.split(":")[0];
   return `http://${hostname}:${PAYJSAPI_PORT}`;
 }
@@ -97,7 +98,7 @@ export function getPocketBaseConfig(themeOverride?: { joinCollection?: string })
 export function getPaymentConfig(themeOverride?: { amount?: number; type?: string }): PaymentConfig {
   const base = {
     enabled: true,
-    apiUrl: process.env.PAYMENT_API_URL || DEFAULT_PAYMENT_API_URL,
+    apiUrl: resolvePaymentApiUrl(),
     provider: (process.env.PAYMENT_PROVIDER as "zpay" | "xorpay") || "zpay",
     defaultAmount: Number(process.env.PAYMENT_DEFAULT_AMOUNT) || 8800,
     defaultType: process.env.PAYMENT_DEFAULT_TYPE || "meetup",