diff --git a/frontend/e2e/demo.spec.ts b/frontend/e2e/demo.spec.ts
index 8c5c546..d9b0899 100644
--- a/frontend/e2e/demo.spec.ts
+++ b/frontend/e2e/demo.spec.ts
@@ -1,13 +1,11 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
-const API_BASE = process.env.MOBILITYOPS_API_URL ?? "http://localhost:8128";
-
 async function resetDemoData(request: APIRequestContext) {
-  const login = await request.post(`${API_BASE}/api/v1/demo/login`, {
+  const login = await request.post("/api/v1/demo/login", {
     data: { role: "operations_manager" },
   });
   expect(login.ok()).toBeTruthy();
-  const reset = await request.post(`${API_BASE}/api/v1/demo/reset`);
+  const reset = await request.post("/api/v1/demo/reset");
   expect(reset.ok()).toBeTruthy();
 }
 
diff --git a/frontend/e2e/interactive-elements.spec.ts b/frontend/e2e/interactive-elements.spec.ts
index 6b11d69..24bfc66 100644
--- a/frontend/e2e/interactive-elements.spec.ts
+++ b/frontend/e2e/interactive-elements.spec.ts
@@ -1,10 +1,8 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
 async function resetDemoData(request: APIRequestContext) {
-  await request.post("http://localhost:8128/api/v1/demo/login", {
-    data: { role: "operations_manager" },
-  });
-  await request.post("http://localhost:8128/api/v1/demo/reset");
+  await request.post("/api/v1/demo/login", { data: { role: "operations_manager" } });
+  await request.post("/api/v1/demo/reset");
 }
 
 test.describe.configure({ mode: "serial" });
@@ -248,20 +246,16 @@ test("rental employee role has a restricted nav and cannot reach manager-only pa
 
 test("rental employee direct API access to manager-only endpoints is rejected", async ({
   page,
-  request,
 }) => {
   await page.getByRole("button", { name: "Switch role" }).click();
   await page.getByRole("button", { name: "Open as Rental Employee" }).click();
   await expect(page).toHaveURL(/\/dashboard$/);
 
-  const cookies = await page.context().cookies();
-  const sessionCookie = cookies.find((c) => c.name === "mobilityops_session");
-  const cookieHeader = sessionCookie ? `${sessionCookie.name}=${sessionCookie.value}` : "";
-
+  // page.request shares the browser context's cookies, and (via the web container's
+  // nginx /api/ proxy) works identically against localhost and the deployed server --
+  // the backend API itself is never exposed directly on either.
   for (const path of ["/api/v1/data-quality/issues", "/api/v1/audit", "/api/v1/workflows"]) {
-    const response = await request.get(`http://localhost:8128${path}`, {
-      headers: { Cookie: cookieHeader },
-    });
+    const response = await page.request.get(path);
     expect(response.status(), path).toBe(403);
   }
 });
diff --git a/frontend/e2e/ui-redesign.spec.ts b/frontend/e2e/ui-redesign.spec.ts
index b78d0f5..e13136b 100644
--- a/frontend/e2e/ui-redesign.spec.ts
+++ b/frontend/e2e/ui-redesign.spec.ts
@@ -1,10 +1,8 @@
 import { expect, test, type APIRequestContext } from "@playwright/test";
 
-const API_BASE = process.env.MOBILITYOPS_API_URL ?? "http://localhost:8128";
-
 async function resetDemoData(request: APIRequestContext) {
-  await request.post(`${API_BASE}/api/v1/demo/login`, { data: { role: "operations_manager" } });
-  await request.post(`${API_BASE}/api/v1/demo/reset`);
+  await request.post("/api/v1/demo/login", { data: { role: "operations_manager" } });
+  await request.post("/api/v1/demo/reset");
 }
 
 test.beforeEach(async ({ page, request }) => {