diff --git a/stacks/ai/ai-frontend.nomad b/stacks/ai/ai-frontend.nomad
index 9c2e22d..c8f733c 100644
--- a/stacks/ai/ai-frontend.nomad
+++ b/stacks/ai/ai-frontend.nomad
@@ -7,7 +7,6 @@ job "ai-frontend" {
   group "openwebui" {
     count = 1
 
-    # PIN TO HP1 (Corrected Hostname)
     constraint {
       attribute = "${attr.unique.hostname}"
       value     = "hp1-home" 
@@ -36,6 +35,7 @@ job "ai-frontend" {
       driver = "podman"
       
       env {
+        # REVERTED: Now using Consul DNS again
         OLLAMA_BASE_URL = "http://ollama.service.consul:11434"
       }
 
@@ -45,6 +45,10 @@ job "ai-frontend" {
         volumes = [
           "/mnt/local-ssd/nomad/stacks/ai/ai-frontend/openwebui:/app/backend/data"
         ]
+
+        # --- THE FIX: Point DNS to Consul Server ---
+        dns_servers = ["192.168.1.133"]
+        dns_search  = ["service.consul"]
       }
       
       resources { 
@@ -58,7 +62,6 @@ job "ai-frontend" {
   group "lobechat" {
     count = 1
     
-    # PIN TO HP1 (Corrected Hostname)
     constraint {
       attribute = "${attr.unique.hostname}"
       value     = "hp1-home"
@@ -87,13 +90,21 @@ job "ai-frontend" {
       driver = "podman"
       
       env {
+        # REVERTED: Now using Consul DNS again
         OLLAMA_PROXY_URL = "http://ollama.service.consul:11434"
+        
+        # Kept this in, but Authentik will handle security later as you noted
         ACCESS_CODE      = "securepassword123"
       }
 
       config {
-        image = "docker.io/lobehub/lobe-chat"
+        # Pinned version for stability
+        image = "docker.io/lobehub/lobe-chat:v1.143.0"
         ports = ["http"]
+        
+        # --- THE FIX: Point DNS to Consul Server ---
+        dns_servers = ["192.168.1.133"]
+        dns_search  = ["service.consul"]
       }
       
       resources {