diff --git a/client/app.go b/client/app.go
index 761331a..2c0b1a4 100644
--- a/client/app.go
+++ b/client/app.go
@@ -34,6 +34,26 @@ import (
 )
 
 var blockedReportLast sync.Map // processName -> time.Time
+
+var API_BASE = getEnv("API_BASE", "https://sv.rikkeiraia.org")
+
+func getEnv(key, defaultVal string) string {
+	if val := os.Getenv(key); val != "" {
+		return val
+	}
+	return defaultVal
+}
+
+func getWsUrl(apiBase string) string {
+	if strings.HasPrefix(apiBase, "https://") {
+		return strings.Replace(apiBase, "https://", "wss://", 1)
+	}
+	if strings.HasPrefix(apiBase, "http://") {
+		return strings.Replace(apiBase, "http://", "ws://", 1)
+	}
+	return "ws://" + apiBase
+}
+
 var wifiReportLast sync.Map    // ssidKey -> time.Time
 
 var encryptionKey = []byte("simple-care-proctor-secretkey32!") // 32-byte key for AES-256
@@ -430,7 +450,7 @@ func (a *App) syncProfileToServer(s *StudentData) {
 	}
 	bodyBytes, _ := json.Marshal(payload)
 	client := http.Client{Timeout: 5 * time.Second}
-	resp, err := client.Post("http://127.0.0.1:8080/api/student/sync-log", "application/json", bytes.NewBuffer(bodyBytes))
+	resp, err := client.Post(API_BASE+"/api/student/sync-log", "application/json", bytes.NewBuffer(bodyBytes))
 	if err != nil {
 		return
 	}
@@ -716,7 +736,7 @@ func (a *App) refreshNetworkStatus() {
 
 func (a *App) pingBackend() bool {
 	client := http.Client{Timeout: 3 * time.Second}
-	resp, err := client.Get("http://127.0.0.1:8080/api/health")
+	resp, err := client.Get(API_BASE + "/api/health")
 	if err != nil {
 		return false
 	}
@@ -760,7 +780,7 @@ func (a *App) syncLogsToServer() {
 
 	bodyBytes, _ := json.Marshal(payload)
 	client := http.Client{Timeout: 5 * time.Second}
-	resp, err := client.Post("http://127.0.0.1:8080/api/student/sync-log", "application/json", bytes.NewBuffer(bodyBytes))
+	resp, err := client.Post(API_BASE+"/api/student/sync-log", "application/json", bytes.NewBuffer(bodyBytes))
 	if err != nil {
 		return
 	}
@@ -805,7 +825,7 @@ func (a *App) reportBlockedApp(procName string, title string) {
 	}
 	bodyBytes, _ := json.Marshal(payload)
 	client := http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Post("http://127.0.0.1:8080/api/student/report-blocked-app", "application/json", bytes.NewBuffer(bodyBytes))
+	resp, err := client.Post(API_BASE+"/api/student/report-blocked-app", "application/json", bytes.NewBuffer(bodyBytes))
 	if err != nil {
 		log.Printf("[CLIENT] report-blocked-app failed: %v", err)
 		return
@@ -847,7 +867,7 @@ func (a *App) reportWifi(ssid, bssid string) {
 	}
 	bodyBytes, _ := json.Marshal(payload)
 	client := http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Post("http://127.0.0.1:8080/api/student/report-wifi", "application/json", bytes.NewBuffer(bodyBytes))
+	resp, err := client.Post(API_BASE+"/api/student/report-wifi", "application/json", bytes.NewBuffer(bodyBytes))
 	if err != nil {
 		return
 	}
@@ -856,7 +876,7 @@ func (a *App) reportWifi(ssid, bssid string) {
 
 func (a *App) fetchWifiPolicy() {
 	client := http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Get("http://127.0.0.1:8080/api/student/wifi-policy")
+	resp, err := client.Get(API_BASE + "/api/student/wifi-policy")
 	if err != nil {
 		return
 	}
@@ -929,7 +949,7 @@ func (a *App) fetchAllowedApps(classId int64) {
 	}
 	a.mu.Unlock()
 
-	url := fmt.Sprintf("http://127.0.0.1:8080/api/classes/%d/allowed-apps?studentId=%d", classId, studentID)
+	url := fmt.Sprintf("%s/api/classes/%d/allowed-apps?studentId=%d", API_BASE, classId, studentID)
 	client := http.Client{Timeout: 4 * time.Second}
 	resp, err := client.Get(url)
 	if err != nil {
@@ -985,7 +1005,7 @@ func (a *App) fetchStudentStatus(studentID int64) {
 		return
 	}
 	client := http.Client{Timeout: 4 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("http://127.0.0.1:8080/api/student/status?studentRkId=%d", studentID))
+	resp, err := client.Get(fmt.Sprintf("%s/api/student/status?studentRkId=%d", API_BASE, studentID))
 	if err != nil {
 		return
 	}
@@ -1037,7 +1057,7 @@ func (a *App) connectWS() {
 	}
 	a.mu.Unlock()
 
-	wsUrl := fmt.Sprintf("ws://127.0.0.1:8080/ws?role=student&studentId=%d&classId=%d", student.StudentID, classID)
+	wsUrl := fmt.Sprintf("%s/ws?role=student&studentId=%d&classId=%d", getWsUrl(API_BASE), student.StudentID, classID)
 	dialer := websocket.Dialer{HandshakeTimeout: 4 * time.Second}
 	conn, _, err := dialer.Dial(wsUrl, nil)
 	if err != nil {
@@ -1217,7 +1237,7 @@ func (a *App) GetChatConversations() ([]map[string]any, error) {
 	if student == nil {
 		return nil, errors.New("chưa đăng nhập")
 	}
-	url := fmt.Sprintf("http://127.0.0.1:8080/api/student/chat/conversations?studentRkId=%d", student.StudentID)
+	url := fmt.Sprintf("%s/api/student/chat/conversations?studentRkId=%d", API_BASE, student.StudentID)
 	resp, err := http.Get(url)
 	if err != nil {
 		return nil, err
@@ -1239,7 +1259,7 @@ func (a *App) GetChatMessages(staffID uint) ([]map[string]any, error) {
 	if student == nil {
 		return nil, errors.New("chưa đăng nhập")
 	}
-	url := fmt.Sprintf("http://127.0.0.1:8080/api/student/chat/messages?studentRkId=%d&staffId=%d", student.StudentID, staffID)
+	url := fmt.Sprintf("%s/api/student/chat/messages?studentRkId=%d&staffId=%d", API_BASE, student.StudentID, staffID)
 	resp, err := http.Get(url)
 	if err != nil {
 		return nil, err
@@ -1283,7 +1303,7 @@ func (a *App) SendChatMessage(body string) error {
 		"body":        body,
 	}
 	b, _ := json.Marshal(payload)
-	resp, err := http.Post("http://127.0.0.1:8080/api/student/chat/messages", "application/json", bytes.NewReader(b))
+	resp, err := http.Post(API_BASE+"/api/student/chat/messages", "application/json", bytes.NewReader(b))
 	if err != nil {
 		return err
 	}
@@ -1355,7 +1375,7 @@ func (a *App) GetExamPaperViewURL() (string, error) {
 	if !exam.PaperSent {
 		return "", errors.New("Giảng viên chưa gửi đề")
 	}
-	return fmt.Sprintf("http://127.0.0.1:8080/api/student/exam/download?studentRkId=%d&kind=pdf&view=1", studentID), nil
+	return fmt.Sprintf("%s/api/student/exam/download?studentRkId=%d&kind=pdf&view=1", API_BASE, studentID), nil
 }
 
 func (a *App) GetExamQuizViewURL() (string, error) {
@@ -1378,7 +1398,7 @@ func (a *App) GetExamPaperFiles() (map[string]any, error) {
 	if !exam.PaperSent {
 		return nil, errors.New("Giảng viên chưa gửi đề")
 	}
-	apiURL := fmt.Sprintf("http://127.0.0.1:8080/api/student/exam/paper-files?studentRkId=%d", studentID)
+	apiURL := fmt.Sprintf("%s/api/student/exam/paper-files?studentRkId=%d", API_BASE, studentID)
 	resp, err := http.Get(apiURL)
 	if err != nil {
 		return nil, err
@@ -1391,7 +1411,7 @@ func (a *App) GetExamPaperFiles() (map[string]any, error) {
 	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
 		return nil, err
 	}
-	base := "http://127.0.0.1:8080"
+	base := API_BASE
 	if pdf, ok := payload["pdfUrl"].(string); ok && pdf != "" && !strings.HasPrefix(pdf, "http") {
 		payload["pdfUrl"] = base + pdf
 	}
@@ -1445,8 +1465,8 @@ func (a *App) OpenExamResource(fileID uint) error {
 		return errors.New("tài nguyên không hợp lệ")
 	}
 	viewURL := fmt.Sprintf(
-		"http://127.0.0.1:8080/api/student/exam/download?studentRkId=%d&kind=resource&fileId=%d&view=1",
-		studentID, fileID,
+		"%s/api/student/exam/download?studentRkId=%d&kind=resource&fileId=%d&view=1",
+		API_BASE, studentID, fileID,
 	)
 	title := "Tài nguyên đề thi"
 	files, err := a.GetExamPaperFiles()
@@ -1538,8 +1558,8 @@ func (a *App) DownloadExamResource(fileID uint) (string, error) {
 		}
 	}
 	dlURL := fmt.Sprintf(
-		"http://127.0.0.1:8080/api/student/exam/download?studentRkId=%d&kind=resource&fileId=%d",
-		studentID, fileID,
+		"%s/api/student/exam/download?studentRkId=%d&kind=resource&fileId=%d",
+		API_BASE, studentID, fileID,
 	)
 	resp, err := http.Get(dlURL)
 	if err != nil {
@@ -1570,7 +1590,7 @@ func (a *App) DownloadExamResource(fileID uint) (string, error) {
 // LoadExamViewFile tải file đề/tài nguyên qua Go (không mở URL trực tiếp trong WebView).
 func (a *App) LoadExamViewFile(fileURL string) (map[string]any, error) {
 	fileURL = strings.TrimSpace(fileURL)
-	if !strings.HasPrefix(fileURL, "http://127.0.0.1:8080/api/student/exam/download") {
+	if !strings.HasPrefix(fileURL, API_BASE + "/api/student/exam/download") {
 		return nil, errors.New("URL không hợp lệ")
 	}
 	if _, _, err := a.examStudentContext(); err != nil {
@@ -1646,7 +1666,7 @@ func (a *App) SubmitExamWork() (string, error) {
 	}
 	_ = w.Close()
 
-	req, err := http.NewRequest("POST", "http://127.0.0.1:8080/api/student/exam/submit", &body)
+	req, err := http.NewRequest("POST", API_BASE + "/api/student/exam/submit", &body)
 	if err != nil {
 		return "", err
 	}
diff --git a/client/build/appicon.png b/client/build/appicon.png
index 026b8f0..cd4a399 100644
Binary files a/client/build/appicon.png and b/client/build/appicon.png differ
diff --git a/client/build/windows/icon.ico b/client/build/windows/icon.ico
index f334798..3c0a510 100644
Binary files a/client/build/windows/icon.ico and b/client/build/windows/icon.ico differ