diff --git a/WheelWizard/Features/Recomp/RecompRetroWfcPayloadProbe.cs b/WheelWizard/Features/Recomp/RecompRetroWfcPayloadProbe.cs
index 90e60c4f..151437f7 100644
--- a/WheelWizard/Features/Recomp/RecompRetroWfcPayloadProbe.cs
+++ b/WheelWizard/Features/Recomp/RecompRetroWfcPayloadProbe.cs
@@ -23,12 +23,11 @@ public sealed class RecompRetroWfcPayloadProbe(IHttpClientFactory httpClientFact
     /// <summary>
     /// The fixed payload endpoint the setup host downloads from. It must stay identical to the value pinned
     /// in the recomp's <c>RetroWfcPayload.CurrentRetroWfcPayloadUri</c>, since probing anything else says
-    /// nothing about whether the host's own download will succeed. Plain HTTP is what the service offers
-    /// and what the host pins; that is safe here because this probe decides nothing about trust. The host
-    /// verifies the payload's RSA signature itself, so a forged answer can at worst make the host attempt
-    /// a download that its own verification then rejects.
+    /// nothing about whether the host's own download will succeed. This probe decides nothing about trust:
+    /// the host verifies the payload's RSA signature itself, so a forged answer can at worst make the host
+    /// attempt a download that its own verification then rejects.
     /// </summary>
-    public const string PayloadUri = "http://nas.play.rwfc.net/payload?g=RMCPD00";
+    public const string PayloadUri = "https://rwfc.net/api/wfc/payload?g=RMCPD00";
 
     // A dead endpoint times out rather than refusing, so a short cap is what keeps the home page and the
     // install flow from stalling on every status refresh while the service is down.