diff --git a/apps/web/src/app/(auth)/login/page.tsx b/apps/web/src/app/(auth)/login/page.tsx
index b77ca0e..e054cbf 100644
--- a/apps/web/src/app/(auth)/login/page.tsx
+++ b/apps/web/src/app/(auth)/login/page.tsx
@@ -7,7 +7,8 @@ import LoginForm from "./login-form";
 export const dynamic = "force-dynamic";
 
 async function getOrganizations(): Promise<Organization[]> {
-  const base = process.env.NEXT_PUBLIC_API_URL || "http://localhost:8080";
+  // 服务端 SSR 用内网地址，不使用 NEXT_PUBLIC_* 避免泄露到客户端
+  const base = process.env.API_URL || "http://localhost:8080";
   try {
     const res = await fetch(`${base}/api/v1/organizations`, {
       cache: "no-store",