diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59f10a8..9ee5a13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,15 @@
 
 ## Versión actual
 
-- Versión base: `1.2.2`
+- Versión base: `1.2.3`
 
 ## Historial
 
+### 1.2.3 - 2026-04-23
+
+- La web fuerza uso de `/api` y `/api/downloads/android-apk` cuando corre en `sign.linkedcorp.net`, evitando compilar enlaces de producción con IPs de desarrollo.
+- Se corrigen referencias heredadas del servidor `192.168.222.72` hacia `192.168.222.40` en configuraciones y documentación de desarrollo.
+
 ### 1.2.2 - 2026-04-23
 
 - Android vuelve a ofrecer activar huella después del login siempre que el acceso biométrico no esté activo.
diff --git a/VERSION b/VERSION
index 23aa839..0495c4a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.2
+1.2.3
diff --git a/android/README.md b/android/README.md
index 0ee1479..72d2e79 100644
--- a/android/README.md
+++ b/android/README.md
@@ -58,7 +58,7 @@ android/
 Por defecto la app apunta a:
 
 ```text
-http://192.168.222.72:4000
+http://192.168.222.40:4000
 ```
 
 Ese valor está en:
diff --git a/android/app/build.gradle b/android/app/build.gradle
index 89046f5..471e73d 100644
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -18,8 +18,8 @@ android {
         applicationId "net.linkedcorp.linkedsign"
         minSdk 26
         targetSdk 35
-        versionCode 10202
-        versionName "1.2.2"
+        versionCode 10203
+        versionName "1.2.3"
 
         buildConfigField "String", "API_BASE_URL", "\"${apiBaseUrl}\""
     }
diff --git a/android_react/README.md b/android_react/README.md
index bc7c18c..b06417c 100644
--- a/android_react/README.md
+++ b/android_react/README.md
@@ -61,7 +61,7 @@ Valor actual:
 {
   "expo": {
     "extra": {
-      "apiBaseUrl": "http://192.168.222.72:4000"
+      "apiBaseUrl": "http://192.168.222.40:4000"
     }
   }
 }
diff --git a/android_react/app.json b/android_react/app.json
index 4eca3d9..4b5450c 100644
--- a/android_react/app.json
+++ b/android_react/app.json
@@ -16,7 +16,7 @@
       "package": "net.linkedcorp.linkedsign"
     },
     "extra": {
-      "apiBaseUrl": "http://192.168.222.72:4000"
+      "apiBaseUrl": "http://192.168.222.40:4000"
     }
   }
 }
diff --git a/android_react/src/config/env.js b/android_react/src/config/env.js
index dcbcff5..bd00dcc 100644
--- a/android_react/src/config/env.js
+++ b/android_react/src/config/env.js
@@ -5,4 +5,4 @@ const extra = Constants.expoConfig?.extra || {};
 export const API_BASE_URL =
   process.env.EXPO_PUBLIC_API_BASE_URL ||
   extra.apiBaseUrl ||
-  'http://192.168.222.72:4000';
+  'http://192.168.222.40:4000';
diff --git a/backend/README.md b/backend/README.md
index 02008db..97de2b6 100644
--- a/backend/README.md
+++ b/backend/README.md
@@ -33,8 +33,8 @@ Variables importantes:
 
 ```env
 PORT=4000
-CORS_ORIGIN=http://192.168.222.72:5173
-FRONTEND_URL=http://192.168.222.72:5173
+CORS_ORIGIN=http://192.168.222.40:5173
+FRONTEND_URL=http://192.168.222.40:5173
 MAIL_HOST=
 MAIL_PORT=587
 MAIL_SECURE=false
@@ -73,7 +73,7 @@ DB_NAME=
 Registra usuario y envía correo de validación.
 
 ```bash
-curl -X POST http://192.168.222.72:4000/auth/register \
+curl -X POST http://192.168.222.40:4000/auth/register \
   -H "Content-Type: application/json" \
   -d '{
     "email": "usuario@correo.com",
@@ -86,7 +86,7 @@ curl -X POST http://192.168.222.72:4000/auth/register \
 Inicia sesión. Si el correo no está validado, reenvía el enlace.
 
 ```bash
-curl -X POST http://192.168.222.72:4000/auth/login \
+curl -X POST http://192.168.222.40:4000/auth/login \
   -H "Content-Type: application/json" \
   -d '{
     "email": "usuario@correo.com",
@@ -117,7 +117,7 @@ Devuelve usuario autenticado y preferencias visuales de firma.
 Sube un PDF original.
 
 ```bash
-curl -X POST http://192.168.222.72:4000/documents \
+curl -X POST http://192.168.222.40:4000/documents \
   -H "Authorization: Bearer TU_ACCESS_TOKEN" \
   -F "file=@/ruta/documento.pdf"
 ```
@@ -137,7 +137,7 @@ Descarga un documento original.
 Sube un certificado `.p12` o `.pfx`.
 
 ```bash
-curl -X POST http://192.168.222.72:4000/certificates \
+curl -X POST http://192.168.222.40:4000/certificates \
   -H "Authorization: Bearer TU_ACCESS_TOKEN" \
   -F "file=@/ruta/certificado.p12" \
   -F "alias=MPGH 2026" \
@@ -155,7 +155,7 @@ Lista certificados del usuario, incluyendo datos de cadena embebida.
 Firma un documento con un certificado del usuario.
 
 ```bash
-curl -X POST http://192.168.222.72:4000/signatures/sign \
+curl -X POST http://192.168.222.40:4000/signatures/sign \
   -H "Authorization: Bearer TU_ACCESS_TOKEN" \
   -H "Content-Type: application/json" \
   -d '{
diff --git a/backend/package.json b/backend/package.json
index 8a76a3a..5a986dd 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "linkedsign-backend",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "private": true,
   "description": "Initial backend for LinkedSign",
   "main": "src/server.js",
diff --git a/frontend/package.json b/frontend/package.json
index 6a57e4d..2300842 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "1.2.2",
+  "version": "1.2.3",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/frontend/src/api/client.js b/frontend/src/api/client.js
index 3a80735..f4a7c9b 100644
--- a/frontend/src/api/client.js
+++ b/frontend/src/api/client.js
@@ -5,8 +5,9 @@ import {
   getAccessToken,
   setAccessToken,
 } from '../utils/session';
+import { resolveApiUrl } from '../config/api';
 
-const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:4000';
+const API_URL = resolveApiUrl();
 
 const client = axios.create({
   baseURL: API_URL,
diff --git a/frontend/src/api/public.js b/frontend/src/api/public.js
index 3b0d3b7..7fb9cd1 100644
--- a/frontend/src/api/public.js
+++ b/frontend/src/api/public.js
@@ -1,6 +1,7 @@
 import axios from 'axios';
+import { resolveApiUrl } from '../config/api';
 
-const API_URL = import.meta.env.VITE_API_URL || 'http://localhost:4000';
+const API_URL = resolveApiUrl();
 
 export const verifySignature = (code) => axios.get(`${API_URL}/signatures/verify/${code}`);
 export const getLegalTemplates = () => axios.get(`${API_URL}/legal/templates`);
diff --git a/frontend/src/config/api.js b/frontend/src/config/api.js
new file mode 100644
index 0000000..a7b4fed
--- /dev/null
+++ b/frontend/src/config/api.js
@@ -0,0 +1,17 @@
+const normalize = (value) => String(value || '').replace(/\/$/, '');
+
+export const resolveApiUrl = () => {
+  if (typeof window !== 'undefined' && window.location?.hostname === 'sign.linkedcorp.net') {
+    return '/api';
+  }
+
+  return normalize(import.meta.env.VITE_API_URL || 'http://192.168.222.40:4000');
+};
+
+export const resolveAndroidApkUrl = () => {
+  if (typeof window !== 'undefined' && window.location?.hostname === 'sign.linkedcorp.net') {
+    return '/api/downloads/android-apk';
+  }
+
+  return `${resolveApiUrl()}/downloads/android-apk`;
+};
diff --git a/frontend/src/pages/auth/LoginPage.jsx b/frontend/src/pages/auth/LoginPage.jsx
index 498e8e3..3d63c26 100644
--- a/frontend/src/pages/auth/LoginPage.jsx
+++ b/frontend/src/pages/auth/LoginPage.jsx
@@ -4,6 +4,7 @@ import { useAuth } from '../../contexts/AuthContext';
 import { Download, PenTool } from 'lucide-react';
 import toast from 'react-hot-toast';
 import { SESSION_EXPIRED_MESSAGE, translateApiError } from '../../utils/session';
+import { resolveAndroidApkUrl } from '../../config/api';
 import packageInfo from '../../../package.json';
 
 export default function LoginPage() {
@@ -12,8 +13,7 @@ export default function LoginPage() {
   const [searchParams, setSearchParams] = useSearchParams();
   const [form, setForm] = useState({ email: '', password: '' });
   const [loading, setLoading] = useState(false);
-  const apiBaseUrl = (import.meta.env.VITE_API_URL || 'http://localhost:4000').replace(/\/$/, '');
-  const androidApkUrl = `${apiBaseUrl}/downloads/android-apk`;
+  const androidApkUrl = resolveAndroidApkUrl();
   const showAndroidDownload = useMemo(() => {
     if (typeof navigator === 'undefined') return false;
     return /Android/i.test(navigator.userAgent || '');