diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index 2679f83..ee9e137 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -32,9 +32,9 @@ OpenSandbox chart 所有权边界。
   `FetchTask`；所有 Ready 实例都可通过 backend metadata 恢复 claim 并服务 facade。
 - executor 镜像使用 digest；Pod 以 UID 2000 运行，SPIRE `ClusterStaticEntry` 同时绑定
   具体 Pod UID 与 `unix:uid:2000`。
-- facade 只有 ClusterIP，executor 通过
-  `dynamic-runner-controller.dynamic-runner.svc:8443` 访问；双方使用 Workload API
-  X509-SVID mTLS，不再保留公网 webhook/token endpoint。
+- facade 通过仅内网可路由的 `192.168.10.127:30443` NodePort 提供给 sandbox executor；
+  双方使用 Workload API X509-SVID mTLS，并按 SPIFFE ID 而不是 IP/DNS 名验证服务端。
+  该入口不经过公网或 Cloudflare Tunnel。
 - controller 的 SPIFFE ID 固定为
   `spiffe://ddupan.top/ns/dynamic-runner/sa/dynamic-runner-controller`。
 - NATS 保留既有最小权限分离：`ci-producer` 仅 publish，`ci-worker` 仅 pull/ACK。
diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml
index 04f95dc..c9201c9 100644
--- a/platform/dynamic-runner/deployment.yaml
+++ b/platform/dynamic-runner/deployment.yaml
@@ -63,7 +63,7 @@ spec:
             - name: RUNNER_FACADE_LISTEN
               value: :8443
             - name: RUNNER_FACADE_URL
-              value: https://dynamic-runner-controller.dynamic-runner.svc:8443
+              value: https://192.168.10.127:30443
             - name: RUNNER_FACADE_SPIFFE_ID
               value: spiffe://ddupan.top/ns/dynamic-runner/sa/dynamic-runner-controller
             - name: SPIFFE_ENDPOINT_SOCKET
diff --git a/platform/dynamic-runner/service.yaml b/platform/dynamic-runner/service.yaml
index bcef3db..e527f30 100644
--- a/platform/dynamic-runner/service.yaml
+++ b/platform/dynamic-runner/service.yaml
@@ -4,10 +4,11 @@ metadata:
   name: dynamic-runner-controller
   namespace: dynamic-runner
 spec:
-  type: ClusterIP
+  type: NodePort
   selector:
     app.kubernetes.io/name: dynamic-runner-controller
   ports:
     - name: facade
       port: 8443
       targetPort: facade
+      nodePort: 30443