diff --git a/.env.example b/.env.example
index c9f37d5..e767daa 100644
--- a/.env.example
+++ b/.env.example
@@ -38,4 +38,4 @@ VITE_API_BASE_URL=/api/v1
 
 # Where the Vite dev proxy forwards /api. Only read by vite.config.js, never by
 # client code.
-VITE_API_PROXY_TARGET=https://mcp.korwfoce.com
+VITE_API_PROXY_TARGET=https://mcp.krowforce.com
diff --git a/vite.config.js b/vite.config.js
index 7019f91..2a157fe 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -4,6 +4,39 @@ import { defineConfig } from 'vite';
 
 // The reference app resolves `@/*` through the Base44 Vite plugin. This demo is
 // backend-free, so the alias is declared directly.
+// The API host the dev server forwards to. Only read here; nothing in client
+// code names a backend host.
+const PROXY_TARGET = process.env.VITE_API_PROXY_TARGET || 'https://mcp.krowforce.com';
+
+/**
+ * One proxy entry per path prefix, all pointing at the same backend.
+ *
+ * `secure: true` keeps certificate verification on — the target is a real host
+ * with a real certificate, and turning verification off would hide a genuine
+ * TLS failure behind a working-looking proxy.
+ *
+ * `changeOrigin` rewrites the Host header to the target, which the backend's
+ * TLS termination requires to route the request at all.
+ */
+function proxyRoutes(prefixes) {
+  return Object.fromEntries(prefixes.map((prefix) => [prefix, {
+    target: PROXY_TARGET,
+    changeOrigin: true,
+    secure: true,
+    configure: (proxy) => {
+      proxy.on('error', (err, _req, res) => {
+        console.error('[vite proxy error]:', err.message);
+        if (res && res.writeHead && !res.headersSent) {
+          res.writeHead(502, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({
+            error: `Backend unreachable (${PROXY_TARGET}): ${err.message}`,
+          }));
+        }
+      });
+    },
+  }]));
+}
+
 export default defineConfig({
   plugins: [react()],
   resolve: {
@@ -56,12 +89,6 @@ export default defineConfig({
      * nginx.conf), so this is a development-only shim for a property the
      * deployed app has for free.
      */
-    proxy: {
-      '/api': {
-        target: process.env.VITE_API_PROXY_TARGET || 'https://mcp.korwfoce.com',
-        changeOrigin: true,
-        secure: false,
-      },
-    },
+    proxy: proxyRoutes(['/api', '/health']),
   },
 });