diff --git a/infra/nginx/xiaoxia-saas.conf b/infra/nginx/xiaoxia-saas.conf
index edc8731ff..5fc662770 100644
--- a/infra/nginx/xiaoxia-saas.conf
+++ b/infra/nginx/xiaoxia-saas.conf
@@ -1,9 +1,11 @@
 # Production Nginx routing for XiaoXia SaaS.
 #
-# Domains are intentionally separated:
-# - xiaoxiajianji.com / www.xiaoxiajianji.com: SaaS web UI
-# - api.xiaoxiajianji.com: SaaS API, docs, generated files
+# Final domain roles:
+# - saas.xiaoxiajianji.com: SaaS web UI
+# - saas-api.xiaoxiajianji.com: SaaS API, docs, generated files
+# - api.xiaoxiajianji.com: legacy-compatible SaaS API entry
 # - git.xiaoxiajianji.com: Gitea code repository
+# - xiaoxiajianji.com / www.xiaoxiajianji.com: brand/root entry, redirect to SaaS web
 
 server {
     listen 443 ssl http2;
@@ -14,6 +16,18 @@ server {
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
+    return 301 https://saas.xiaoxiajianji.com$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name saas.xiaoxiajianji.com;
+
+    ssl_certificate /etc/letsencrypt/live/xiaoxiajianji.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xiaoxiajianji.com/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
     client_max_body_size 100m;
 
     location / {
@@ -30,10 +44,10 @@ server {
 
 server {
     listen 443 ssl http2;
-    server_name api.xiaoxiajianji.com;
+    server_name saas-api.xiaoxiajianji.com api.xiaoxiajianji.com;
 
-    ssl_certificate /etc/letsencrypt/live/api.xiaoxiajianji.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/api.xiaoxiajianji.com/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/xiaoxiajianji.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xiaoxiajianji.com/privkey.pem;
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
@@ -93,8 +107,8 @@ server {
     listen 443 ssl http2;
     server_name git.xiaoxiajianji.com;
 
-    ssl_certificate /etc/letsencrypt/live/git.xiaoxiajianji.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/git.xiaoxiajianji.com/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/xiaoxiajianji.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xiaoxiajianji.com/privkey.pem;
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
@@ -116,13 +130,19 @@ server {
 server {
     listen 80;
     server_name xiaoxiajianji.com www.xiaoxiajianji.com;
-    return 301 https://xiaoxiajianji.com$request_uri;
+    return 301 https://saas.xiaoxiajianji.com$request_uri;
 }
 
 server {
     listen 80;
-    server_name api.xiaoxiajianji.com;
-    return 301 https://api.xiaoxiajianji.com$request_uri;
+    server_name saas.xiaoxiajianji.com;
+    return 301 https://saas.xiaoxiajianji.com$request_uri;
+}
+
+server {
+    listen 80;
+    server_name saas-api.xiaoxiajianji.com api.xiaoxiajianji.com;
+    return 301 https://$host$request_uri;
 }
 
 server {