diff --git a/conf.d/assets-ai.conf b/conf.d/assets-ai.conf
index 448c59e..1ff17d5 100644
--- a/conf.d/assets-ai.conf
+++ b/conf.d/assets-ai.conf
@@ -2,8 +2,8 @@ server {
     listen 443 ssl;
     server_name assets.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location /_next/static/ {
         proxy_pass http://assets-ai:3000;
diff --git a/conf.d/git-ai.conf b/conf.d/git-ai.conf
index 7dc047d..7b373fe 100644
--- a/conf.d/git-ai.conf
+++ b/conf.d/git-ai.conf
@@ -2,8 +2,8 @@ server {
     listen 443 ssl;
     server_name git.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     # Gitea 通过 OIDC 认证，不走 auth_request，只需基本反向代理
     location / {
diff --git a/conf.d/issue-ai.conf b/conf.d/issue-ai.conf
index e2c9023..cee276b 100644
--- a/conf.d/issue-ai.conf
+++ b/conf.d/issue-ai.conf
@@ -2,8 +2,8 @@ server {
     listen 443 ssl;
     server_name issue.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location /_next/static/ {
         proxy_pass http://issue-ai:3000;
diff --git a/conf.d/root-domain.conf b/conf.d/root-domain.conf
index 545b7f9..4e836fe 100644
--- a/conf.d/root-domain.conf
+++ b/conf.d/root-domain.conf
@@ -5,8 +5,8 @@ server {
     server_name tlyq.ai;
 
     # 共用现有证书
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     return 301 https://www.tlyq.ai$request_uri;
 }
diff --git a/conf.d/www-ai.conf b/conf.d/www-ai.conf
index c7878d8..16d8aa9 100644
--- a/conf.d/www-ai.conf
+++ b/conf.d/www-ai.conf
@@ -2,8 +2,8 @@ server {
     listen 443 ssl;
     server_name www.tlyq.ai;
 
-    ssl_certificate /etc/letsencrypt/live/oa.tlyq.ai/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/oa.tlyq.ai/privkey.pem;
+    ssl_certificate /etc/letsencrypt/live/www.tlyq.ai/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.tlyq.ai/privkey.pem;
 
     location /_next/static/ {
         resolver 127.0.0.11 valid=30s;