diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3fe1666..9918abc 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -126,6 +126,20 @@ docker-migrations:
   script:
     - *publish_script
 
+# Admin UI — независимый от Maven (Node build), но публикуется в тот же registry.
+docker-admin-ui:
+  extends: .docker_base
+  needs: []
+  variables:
+    SVC: ordinis-admin-ui
+    DOCKERFILE: ordinis-admin-ui/Dockerfile
+    BUILD_CONTEXT: ordinis-admin-ui/
+  script:
+    - *publish_script
+  rules:
+    - changes: ["ordinis-admin-ui/**/*"]
+    - if: '$CI_COMMIT_BRANCH == "main"'
+
 # ─── TRIGGER DEPLOY (downstream pipeline) ──────
 # GitLab quirk: variables: в trigger job НЕ интерполируются от upstream global
 # variables напрямую — `$IMAGE_TAG` передавался как литерал. Workaround:
diff --git a/ordinis-admin-ui/nginx.conf b/ordinis-admin-ui/nginx.conf
index 72faf03..69875a0 100644
--- a/ordinis-admin-ui/nginx.conf
+++ b/ordinis-admin-ui/nginx.conf
@@ -2,35 +2,33 @@ server {
   listen 80;
   server_name _;
 
-  # SPA history fallback
+  # Real client IP behind ingress-nginx.
+  set_real_ip_from 0.0.0.0/0;
+  real_ip_header X-Forwarded-For;
+  real_ip_recursive on;
+
+  # SPA history fallback.
   root /usr/share/nginx/html;
   index index.html;
 
+  # GET /api/v1/dictionaries и /api/v1/<name>/records → read-api.
+  # POST/PUT/PATCH/DELETE на тех же путях → writer (ordinis-app).
+  # Method-based routing через map.
+  location /api/v1/ {
+    set $backend "ordinis-read-api";
+    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
+      set $backend "ordinis-app";
+    }
+    proxy_pass http://$backend;
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_pass_request_headers on;
+  }
+
   location / {
     try_files $uri $uri/ /index.html;
   }
-
-  # API proxy в read-api/writer (через k8s service DNS).
-  # Реальный endpoint задаётся через env-template или ENV в pod, в v1
-  # просто проксируем на ordinis-read-api (только GET) и ordinis-app (write).
-  location /api/v1/dictionaries {
-    # POST/PUT идут в writer, GET — в read-api. Простое разделение по methods:
-    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
-      proxy_pass http://ordinis-app:80;
-    }
-    proxy_pass http://ordinis-read-api:80;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_pass_request_headers on;
-  }
-
-  location ~ ^/api/v1/[^/]+/records {
-    if ($request_method ~ ^(POST|PUT|PATCH|DELETE)$) {
-      proxy_pass http://ordinis-app:80;
-    }
-    proxy_pass http://ordinis-read-api:80;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_pass_request_headers on;
-  }
 }