diff --git a/README.md b/README.md
index d186959..ca52487 100644
--- a/README.md
+++ b/README.md
@@ -137,8 +137,7 @@ Claw Box 是无屏设备，通过 WiFi 热点完成网络配置。
 连接成功后，手机通常会**自动弹出配网页面**。
 
 如果没有弹出，请手动打开浏览器访问：
-- `http://ap.cutos.ai`
-- 或 `http://10.42.0.1`
+- `http://10.42.0.1`
 
 **第四步：选择 WiFi 并连接**
 
diff --git a/install.sh b/install.sh
index 95b3e46..254f16f 100644
--- a/install.sh
+++ b/install.sh
@@ -207,10 +207,8 @@ MemoryMax=256M
 CPUQuota=50%
 TasksMax=64
 
-# 安全加固
-NoNewPrivileges=true
-ProtectSystem=strict
-ProtectHome=read-only
+# 安全加固（ttyd 子进程需要 setuid sudo，不能用 NoNewPrivileges/strict）
+ProtectSystem=full
 ReadWritePaths=$CONFIG_DIR /tmp
 
 # 日志
diff --git a/lib/dns-hijack.js b/lib/dns-hijack.js
index 7c4376e..6783349 100644
--- a/lib/dns-hijack.js
+++ b/lib/dns-hijack.js
@@ -4,7 +4,7 @@ const fs   = require('fs');
 const path = require('path');
 const log  = require('./logger');
 
-const CAPTIVE_DOMAIN = 'ap.cutos.ai';
+const CAPTIVE_DOMAIN = '10.42.0.1';
 
 const NM_DNSMASQ_DIR  = '/etc/NetworkManager/dnsmasq-shared.d';
 const CAPTIVE_CONF    = path.join(NM_DNSMASQ_DIR, 'clawd-captive.conf');
diff --git a/lib/provisioning.js b/lib/provisioning.js
index 4dfde9b..72b3c7f 100644
--- a/lib/provisioning.js
+++ b/lib/provisioning.js
@@ -146,7 +146,7 @@ class ProvisionManager extends EventEmitter {
 
       this._state = 'ap';
       log.info('provision', `AP 常驻模式已启动: ${ap.ssid}, 密码 12345678`);
-      log.info('provision', `配网地址: http://ap.cutos.ai`);
+      log.info('provision', `配网地址: http://10.42.0.1`);
     } catch (e) {
       log.error('provision', `AP 启动失败: ${e.message}`);
     }