diff --git a/deploy/nginx-jiu-ali.conf b/deploy/nginx-jiu-ali.conf
index ff08dc4..36ffb35 100644
--- a/deploy/nginx-jiu-ali.conf
+++ b/deploy/nginx-jiu-ali.conf
@@ -17,11 +17,10 @@ server {
     listen 443 ssl http2 default_server; # 正式入口（备案后回切 2026-07-03）
     server_name jiu.51yanmei.com _;
 
-    # 证书现为 EC2 同步副本（2026-08-28 到期）。ACME 通道已就绪：待批准后在 ali 跑
-    # `certbot certonly --webroot -w /var/www/acme -d jiu.51yanmei.com` 签新证，
-    # 然后把这两行换成 /etc/letsencrypt/live/jiu.51yanmei.com/ 并配 reload 部署钩子。
-    ssl_certificate     /etc/nginx/ssl/jiu.51yanmei.com/fullchain.pem;
-    ssl_certificate_key /etc/nginx/ssl/jiu.51yanmei.com/privkey.pem;
+    # 证书：certbot webroot 自动续期（certbot-renew.timer 每日 + deploy 钩子 reload；
+    # 2026-07-03 签发，authenticator=webroot，dry-run 验证通过）
+    ssl_certificate     /etc/letsencrypt/live/jiu.51yanmei.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/jiu.51yanmei.com/privkey.pem;
     ssl_protocols       TLSv1.2 TLSv1.3;
     ssl_ciphers         HIGH:!aNULL:!MD5;
     ssl_prefer_server_ciphers on;