diff --git a/hosts/sophia.yaml b/hosts/sophia.yaml
index 3f28389..222e00f 100644
--- a/hosts/sophia.yaml
+++ b/hosts/sophia.yaml
@@ -7,7 +7,7 @@ os: linux
 role: workshop
 host: hubris
 pve_id: 119
-lan_ip: 192.168.8.157
+lan_ip: 192.168.8.109
 mesh:
   tailscale:
     fqdn: sophia
diff --git a/inventory.yaml b/inventory.yaml
index 5a18520..fa560f8 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -221,7 +221,7 @@ hosts:
     host: hubris
     os: linux
     role: workshop
-    lan_ip: 192.168.8.157
+    lan_ip: 192.168.8.109
     mesh:
       tailscale:
         fqdn: sophia
diff --git a/scripts/check-caddy-backends.sh b/scripts/check-caddy-backends.sh
index c8d4cfd..0dcf3d3 100755
--- a/scripts/check-caddy-backends.sh
+++ b/scripts/check-caddy-backends.sh
@@ -2,6 +2,7 @@
 # check-caddy-backends.sh — validate all Caddy reverse_proxy targets are reachable
 # Run this on hubris (192.168.8.77) or any host on the homelab LAN.
 # Returns non-zero if any backend is unreachable.
+# Uses curl with a short timeout for reliable TCP checks.
 set -o pipefail
 
 CADDY_HOST="192.168.8.175"
@@ -24,9 +25,11 @@ FAILED=0
 while read -r target; do
   [ -z "$target" ] && continue
   TOTAL=$((TOTAL + 1))
-  ip_port=(${target//:/ })
-  if timeout 3 bash -c "echo >/dev/tcp/${ip_port[0]}/${ip_port[1]}" 2>/dev/null; then
+  # Use curl with 3s connect timeout for reliable TCP check
+  if timeout 3 curl -s -o /dev/null --connect-timeout 2 "$target" 2>/dev/null; then
     echo "  ✅ $target"
+  elif timeout 2 bash -c "echo >/dev/tcp/${target/:/\/}" 2>/dev/null; then
+    echo "  ⚠️ $target — port open, no HTTP response"
   else
     echo "  ❌ $target — unreachable"
     FAILED=$((FAILED + 1))