diff --git a/agent/app/config.py b/agent/app/config.py
index cb2a192..9507058 100644
--- a/agent/app/config.py
+++ b/agent/app/config.py
@@ -17,7 +17,7 @@ def _default_allowed_download_hosts(base_url: str) -> list[str]:
     parsed = urlparse(base_url)
     if parsed.hostname:
         return [parsed.hostname]
-    return ["robot.package"]
+    return ["package.pnkr.cloud"]
 
 
 @dataclass(frozen=True)
@@ -49,7 +49,7 @@ def _bool(name: str, default: bool) -> bool:
 
 @lru_cache(maxsize=1)
 def get_settings() -> Settings:
-    robot_package_base_url = os.getenv("ROBOT_PACKAGE_BASE_URL", "https://robot.package").rstrip("/")
+    robot_package_base_url = os.getenv("ROBOT_PACKAGE_BASE_URL", "https://package.pnkr.cloud").rstrip("/")
     return Settings(
         agent_version=os.getenv("AGENT_VERSION", "1.0.0"),
         host=os.getenv("AGENT_HOST", "127.0.0.1"),
@@ -57,7 +57,7 @@ def get_settings() -> Settings:
         robot_package_base_url=robot_package_base_url,
         allowed_origins=_csv(
             os.getenv("ALLOWED_ORIGINS"),
-            ["https://robot.installer", "http://localhost:3000", "http://localhost:5173"],
+            ["https://app.pnkr.cloud", "https://package.pnkr.cloud", "http://localhost:3000", "http://localhost:5173"],
         ),
         allowed_download_hosts=_csv(
             os.getenv("ALLOWED_DOWNLOAD_HOSTS"),
diff --git a/agent/scripts/build-deb.sh b/agent/scripts/build-deb.sh
index 9924406..6b3405d 100644
--- a/agent/scripts/build-deb.sh
+++ b/agent/scripts/build-deb.sh
@@ -55,9 +55,9 @@ cat > "${BUILD_DIR}/etc/local-installer-agent/agent.env" <<EOF
 AGENT_VERSION=${VERSION}
 AGENT_HOST=127.0.0.1
 AGENT_PORT=5010
-ROBOT_PACKAGE_BASE_URL=https://robot.package
-ALLOWED_ORIGINS=https://robot.installer,http://localhost:3000,http://localhost:5173
-ALLOWED_DOWNLOAD_HOSTS=robot.package
+ROBOT_PACKAGE_BASE_URL=https://package.pnkr.cloud
+ALLOWED_ORIGINS=https://app.pnkr.cloud,https://package.pnkr.cloud,http://localhost:3000,http://localhost:5173
+ALLOWED_DOWNLOAD_HOSTS=package.pnkr.cloud
 ALLOWED_DOCKER_REGISTRIES=registry.robot.package
 CACHE_DIR=/var/cache/local-installer-agent/packages
 APP_DIR=/opt/robot-apps
diff --git a/web-client/.env.example b/web-client/.env.example
index 3cfd77f..6fd7271 100644
--- a/web-client/.env.example
+++ b/web-client/.env.example
@@ -2,10 +2,10 @@
 WEB_CLIENT_IMAGE_REPOSITORY=toiiiiday/robot-installer-web-client
 WEB_CLIENT_CONTAINER_NAME=robot-installer-web-client
 WEB_CLIENT_PORT=8080
-IMAGE_TAG=1.0.1
+IMAGE_TAG=1.0.0
 DOCKER_NETWORK=robot-installer-net
 PACKAGE_PROXY_TARGET=http://robot-installer-web-server:3000
 
-VITE_PACKAGE_BASE_URL=
+VITE_PACKAGE_BASE_URL=https://package.pnkr.cloud
 VITE_AGENT_BASE_URL=http://127.0.0.1:5010
 VITE_APP_OPEN_URL=http://127.0.0.1
diff --git a/web-server/.env.example b/web-server/.env.example
index e3fda6d..f13df78 100644
--- a/web-server/.env.example
+++ b/web-server/.env.example
@@ -1,8 +1,8 @@
 PORT=3000
 WEB_SERVER_IMAGE_REPOSITORY=toiiiiday/robot-installer-web-server
 WEB_SERVER_CONTAINER_NAME=robot-installer-web-server
-WEB_SERVER_PORT=3000
-IMAGE_TAG=1.0.1
+WEB_SERVER_PORT=3005
+IMAGE_TAG=1.0.0
 DOCKER_NETWORK=robot-installer-net
 WEB_SERVER_UPLOADS_DIR=./uploads
 SQLSERVER_HOST=172.20.235.176
@@ -14,11 +14,11 @@ SQLSERVER_ENCRYPT=false
 SQLSERVER_TRUST_SERVER_CERTIFICATE=true
 AUTH_SECRET=change_this_to_a_long_random_value
 SESSION_MAX_AGE_MS=28800000
-SESSION_COOKIE_SECURE=false
+SESSION_COOKIE_SECURE=true
 EMAIL_CONFIRMATION_EXPIRES_MS=86400000
-APP_BASE_URL=http://localhost:3000
+APP_BASE_URL=https://package.pnkr.cloud
 APP_SHOW_ERROR_DETAILS=false
-WEB_CLIENT_ORIGINS=http://localhost:8080,http://localhost:5173,http://localhost:4173,http://localhost:3000,http://127.0.0.1:3000
+WEB_CLIENT_ORIGINS=https://app.pnkr.cloud,http://localhost:8080,http://localhost:5173,http://localhost:4173,http://localhost:3000,http://127.0.0.1:3000
 
 # Mail chính dùng để gửi email xác nhận tới các tài khoản đăng ký
 SMTP_HOST=smtp.gmail.com
diff --git a/web-server/server.js b/web-server/server.js
index 0a9f4f4..6346c10 100644
--- a/web-server/server.js
+++ b/web-server/server.js
@@ -22,7 +22,7 @@ const sessionMaxAgeMs = Number(process.env.SESSION_MAX_AGE_MS || 1000 * 60 * 60
 const authSecret = process.env.AUTH_SECRET || process.env.SESSION_SECRET || 'robot-installer-dev-secret';
 const secureSessionCookie = getBooleanEnv(process.env.SESSION_COOKIE_SECURE, process.env.NODE_ENV === 'production');
 const publicApiCorsOrigins = getCsvEnv(process.env.WEB_CLIENT_ORIGINS || process.env.PUBLIC_API_CORS_ORIGINS, [
-  'https://robot.installer',
+  'https://app.pnkr.cloud',
   'http://localhost:5173',
   'http://localhost:4173'
 ]);
@@ -225,6 +225,10 @@ function getBooleanEnv(value, fallback) {
   return ['1', 'true', 'yes', 'on'].includes(String(value).toLowerCase());
 }
 
+function escapeShellDoubleQuoted(value) {
+  return String(value || '').replace(/(["\\$`])/g, '\\$1');
+}
+
 function isPublicApiCorsPath(pathname) {
   return pathname === '/api/apps'
     || pathname.startsWith('/api/apps/')
@@ -1377,6 +1381,12 @@ app.get('/api/apps/:appCode/versions/:version/manifest', asyncRoute(async (req,
 app.get('/install-agent.sh', (req, res) => {
   const baseUrl = getBaseUrl(req);
   const agentUrl = `${baseUrl}/packages/agent/latest.deb`;
+  const agentAllowedOrigins = Array.from(new Set([
+    baseUrl,
+    ...publicApiCorsOrigins.filter((origin) => origin !== '*'),
+    'http://localhost:3000',
+    'http://127.0.0.1:3000'
+  ])).join(',');
   res.type('text/x-shellscript').send(`#!/usr/bin/env bash
 set -euo pipefail
 
@@ -1408,7 +1418,7 @@ echo "Configuring Local Installer Agent..."
 mkdir -p /etc/local-installer-agent
 touch "$AGENT_ENV"
 set_agent_env ROBOT_PACKAGE_BASE_URL "$PACKAGE_BASE_URL"
-set_agent_env ALLOWED_ORIGINS "$PACKAGE_BASE_URL,http://localhost:3000,http://127.0.0.1:3000"
+set_agent_env ALLOWED_ORIGINS "${escapeShellDoubleQuoted(agentAllowedOrigins)}"
 set_agent_env ALLOWED_DOWNLOAD_HOSTS "$PACKAGE_HOST,localhost,127.0.0.1"
 
 echo "Starting Local Installer Agent..."