diff --git a/apps/web/.env.production b/apps/web/.env.production
index 8982be7..be488b8 100644
--- a/apps/web/.env.production
+++ b/apps/web/.env.production
@@ -1,11 +1,14 @@
-# Production build env for the SPA (auto-loaded by `vite build`, which the Tauri
-# desktop bundle runs via beforeBuildCommand). NOT loaded by `vite` dev.
+# Production build env for the SPA (auto-loaded by `vite build`). NOT loaded by `vite` dev.
 #
-# The desktop shell serves the bundled SPA from tauri://localhost (no proxy, not
-# same-origin), so the SPA must reach Fastify by absolute origin. This is the
-# appliance's local Fastify address. Not a secret — committed for reproducible
-# desktop builds. Override per-deployment if Fastify binds elsewhere.
+# RELATIVE /api base (empty value). The booth serves the SPA same-origin (Fastify serves
+# dist/, reached via Caddy on :80), so requests must stay relative — baking an absolute
+# origin here would point the browser at the wrong host. This matches the deploy
+# (wiki/decisions/container-deployment.md "Web access"; the 77b2acb fix).
 #
-# NOTE: a plain browser prod build (Fastify serving dist/ same-origin) does NOT
-# want this set. If you build the SPA for that, override VITE_API_BASE="" .
-VITE_API_BASE=http://127.0.0.1:3000
+# DESKTOP (Tauri) NOTE: the desktop shell serves the SPA from tauri://localhost (no proxy,
+# not same-origin) and DOES need an absolute Fastify origin — but the desktop app is a
+# DEFERRED, separate task (it's currently hardcoded to localhost:3000; see apps/desktop +
+# the desktop-app-hardcoded-localhost note). When that work resumes, set VITE_API_BASE to
+# the appliance's Fastify origin for the desktop build only (e.g. via apps/desktop or an
+# exported override), NOT here.
+VITE_API_BASE=