diff --git a/nixclient/package.json b/nixclient/package.json
index 612c2f9..95fc701 100644
--- a/nixclient/package.json
+++ b/nixclient/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@nixpanel/cpanel",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/nixclient/src/pages/Login.tsx b/nixclient/src/pages/Login.tsx
index 22d6b4e..6fbf57a 100644
--- a/nixclient/src/pages/Login.tsx
+++ b/nixclient/src/pages/Login.tsx
@@ -49,7 +49,7 @@ export default function Login() {
           </button>
         </form>
 
-        <p className="text-center text-[#64748b] text-xs mt-4">NixClient v0.3.0 · Port 2083</p>
+        <p className="text-center text-[#64748b] text-xs mt-4">NixClient v0.3.1 · Port 2083</p>
       </div>
     </div>
   )
diff --git a/nixserver/package.json b/nixserver/package.json
index 735ac31..3036bb4 100644
--- a/nixserver/package.json
+++ b/nixserver/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@nixpanel/whm",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/nixserver/src/pages/Login.tsx b/nixserver/src/pages/Login.tsx
index ad79a8b..d2d54cf 100644
--- a/nixserver/src/pages/Login.tsx
+++ b/nixserver/src/pages/Login.tsx
@@ -81,7 +81,7 @@ export default function Login() {
         </form>
 
         <p className="text-center text-[#64748b] text-xs mt-4">
-          NixServer v0.3.0 · Port 2087
+          NixServer v0.3.1 · Port 2087
         </p>
       </div>
     </div>
diff --git a/package.json b/package.json
index 9c9091b..453af7e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nixpanel-server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "workspaces": [
     "server",
diff --git a/scripts/install.sh b/scripts/install.sh
index 92287d2..b79c9c9 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -28,7 +28,7 @@ cat <<'EOF'
  Open-Source Web Hosting Control Panel
 EOF
 echo -e "${RESET}"
-echo -e " Version  : ${BOLD}0.3.0${RESET}"
+echo -e " Version  : ${BOLD}0.3.1${RESET}"
 echo -e " GitHub   : ${BOLD}https://github.com/NixReaper/nixpanel-server${RESET}"
 echo -e " NixServer: ${BOLD}https://<your-ip>:2087${RESET}"
 echo -e " NixClient: ${BOLD}https://<your-ip>:2083${RESET}"
@@ -351,11 +351,11 @@ JWT_EXPIRES_IN="15m"
 JWT_REFRESH_SECRET="${JWT_REFRESH_SECRET}"
 JWT_REFRESH_EXPIRES_IN="7d"
 
-# Server
+# Server (internal ports — Nginx proxies public 2087/2083 → these)
 NODE_ENV="production"
-NIXSERVER_PORT=2087
-NIXCLIENT_PORT=2083
-HOST="0.0.0.0"
+NIXSERVER_PORT=4000
+NIXCLIENT_PORT=4001
+HOST="127.0.0.1"
 
 # Admin credentials (used during initial seed only)
 ADMIN_USERNAME="${ADMIN_USER}"
@@ -465,6 +465,13 @@ fi
 
 cat > /etc/nginx/sites-available/nixpanel.conf <<NGINX
 # NixPanel — generated by installer
+# Node.js API listens on 127.0.0.1:4000 (internal only)
+# Nginx proxies public ports 2087/2083 → internal API
+
+upstream nixpanel_api {
+    server 127.0.0.1:4000;
+}
+
 # NixServer admin panel on port 2087
 server {
     listen 2087;
@@ -479,7 +486,7 @@ server {
     }
 
     location /api/ {
-        proxy_pass         http://127.0.0.1:2087;
+        proxy_pass         http://nixpanel_api;
         proxy_http_version 1.1;
         proxy_set_header   Upgrade \$http_upgrade;
         proxy_set_header   Connection "upgrade";
@@ -490,7 +497,7 @@ server {
     }
 
     location /ws {
-        proxy_pass         http://127.0.0.1:2087;
+        proxy_pass         http://nixpanel_api;
         proxy_http_version 1.1;
         proxy_set_header   Upgrade \$http_upgrade;
         proxy_set_header   Connection "upgrade";
@@ -510,7 +517,7 @@ server {
     }
 
     location /api/ {
-        proxy_pass         http://127.0.0.1:2087;
+        proxy_pass         http://nixpanel_api;
         proxy_http_version 1.1;
         proxy_set_header   Upgrade \$http_upgrade;
         proxy_set_header   Connection "upgrade";
@@ -631,13 +638,13 @@ step "Waiting for NixPanel to start"
 
 MAX_WAIT=30
 WAITED=0
-until curl -sf http://127.0.0.1:2087/api/health >/dev/null 2>&1; do
+until curl -sf http://127.0.0.1:4000/api/health >/dev/null 2>&1; do
   sleep 2
   WAITED=$((WAITED + 2))
   [[ $WAITED -ge $MAX_WAIT ]] && { warn "Service health check timed out — check: journalctl -u nixpanel -n 50"; break; }
 done
 
-if curl -sf http://127.0.0.1:2087/api/health >/dev/null 2>&1; then
+if curl -sf http://127.0.0.1:4000/api/health >/dev/null 2>&1; then
   success "NixPanel API is responding"
 else
   warn "NixPanel may still be starting. Check status with: systemctl status nixpanel"
diff --git a/server/package.json b/server/package.json
index 792a1c6..ba34b46 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@nixpanel/server",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "main": "dist/index.js",
diff --git a/server/src/app.ts b/server/src/app.ts
index 988a674..e616da0 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -73,7 +73,7 @@ export async function buildApp() {
 
   fastify.get('/api/health', async () => ({
     status: 'ok',
-    version: '0.3.0',
+    version: '0.3.1',
     timestamp: new Date().toISOString(),
   }))
 
diff --git a/server/src/config.ts b/server/src/config.ts
index 18a6108..875e90c 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -16,8 +16,8 @@ export const config = {
 
   server: {
     host: optional('HOST', '0.0.0.0'),
-    nixserverPort: parseInt(optional('NIXSERVER_PORT', '2087'), 10),
-    nixclientPort: parseInt(optional('NIXCLIENT_PORT', '2083'), 10),
+    nixserverPort: parseInt(optional('NIXSERVER_PORT', '4000'), 10),
+    nixclientPort: parseInt(optional('NIXCLIENT_PORT', '4001'), 10),
   },
 
   db: {
diff --git a/server/src/index.ts b/server/src/index.ts
index 90c4356..9a1e4a6 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -13,10 +13,11 @@ async function start() {
 
     app = await buildApp()
 
-    // NixServer on port 2087
+    // Node.js listens on internal port (Nginx proxies public 2087/2083 → here)
     await app.listen({ port: config.server.nixserverPort, host: config.server.host })
-    console.log(`NixServer running on port ${config.server.nixserverPort}`)
-    console.log(`NixClient API running on port ${config.server.nixserverPort} (/api/cpanel)`)
+    console.log(`NixPanel API running on ${config.server.host}:${config.server.nixserverPort}`)
+    console.log(`NixServer admin → http://127.0.0.1:${config.server.nixserverPort}/api/`)
+    console.log(`NixClient user  → http://127.0.0.1:${config.server.nixserverPort}/api/cpanel/`)
 
   } catch (err) {
     console.error('Failed to start server:', err)