diff --git a/deploy/docker-compose.yaml b/deploy/docker-compose.yaml
index 2393144..9c77618 100644
--- a/deploy/docker-compose.yaml
+++ b/deploy/docker-compose.yaml
@@ -8,6 +8,9 @@ services:
     restart: unless-stopped
     expose:
       - "80"
+    networks:
+      # Must share a network with `proxy`, else proxy_pass to `landing` can't resolve.
+      - spaceshell-network
 
   proxy:
     image: nginx:1.27-alpine
diff --git a/deploy/proxy.conf b/deploy/proxy.conf
index 201ce82..8ab1035 100644
--- a/deploy/proxy.conf
+++ b/deploy/proxy.conf
@@ -1,14 +1,16 @@
 # Front nginx for spaceshell.ru — reverse-proxies the landing container and
 # serves macOS .dmg downloads from the host-mounted ./download volume.
-upstream landing_upstream {
-    server landing:80;
-}
-
 server {
     listen 80;
     listen [::]:80;
     server_name spaceshell.ru www.spaceshell.ru;
 
+    # Resolve `landing` at request time via Docker's embedded DNS, so nginx
+    # starts even if the landing container is momentarily down (a static
+    # `upstream { server landing:80; }` makes nginx fail to boot when the name
+    # can't be resolved, restart-looping the proxy → flapping page).
+    resolver 127.0.0.11 valid=10s ipv6=off;
+
     # Stable download URL: /download/spacesh.dmg → ./download/spacesh.dmg on host.
     location /download/ {
         alias /srv/download/;
@@ -21,7 +23,9 @@ server {
     }
 
     location / {
-        proxy_pass http://landing_upstream;
+        # Variable in proxy_pass forces runtime resolution (with the resolver above).
+        set $landing http://landing:80;
+        proxy_pass $landing;
         proxy_set_header Host              $host;
         proxy_set_header X-Real-IP         $remote_addr;
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;