diff --git a/amber/src/main/scala/org/apache/texera/web/resource/pythonvirtualenvironment/PveManager.scala b/amber/src/main/scala/org/apache/texera/web/resource/pythonvirtualenvironment/PveManager.scala
index 2256798030b..1f1eedfe054 100644
--- a/amber/src/main/scala/org/apache/texera/web/resource/pythonvirtualenvironment/PveManager.scala
+++ b/amber/src/main/scala/org/apache/texera/web/resource/pythonvirtualenvironment/PveManager.scala
@@ -94,11 +94,15 @@ object PveManager {
     }
   }
 
+  // The lock file is copied to /tmp/system-requirements-lock.txt inside every
+  // deployed image (see bin/computing-unit-master.dockerfile), so single-node
+  // Docker and Kubernetes both find it there. Only a source-tree dev run reads
+  // the repo-relative amber/ copy. `isLocal` alone can't distinguish a
+  // containerized single-node run (also non-k8s) from a dev run, so probe.
   private def getSystemPath(isLocal: Boolean): Path = {
-    Paths.get(
-      if (isLocal) "amber/system-requirements-lock.txt"
-      else "/tmp/system-requirements-lock.txt"
-    )
+    val deployPath = Paths.get("/tmp/system-requirements-lock.txt")
+    if (Files.exists(deployPath)) deployPath
+    else Paths.get("amber/system-requirements-lock.txt")
   }
 
   def getSystemPackages(isLocal: Boolean): Seq[String] = {
diff --git a/bin/k8s/templates/gateway-routes.yaml b/bin/k8s/templates/gateway-routes.yaml
index ac8096aa212..935d38bb079 100644
--- a/bin/k8s/templates/gateway-routes.yaml
+++ b/bin/k8s/templates/gateway-routes.yaml
@@ -124,20 +124,9 @@ spec:
         - path:
             type: PathPrefix
             value: /api/executions/result/export
-      backendRefs:
-        - group: gateway.envoyproxy.io
-          kind: Backend
-          name: texera-dynamic-backend
-    - matches:
         - path:
             type: PathPrefix
-            value: /pve
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplacePrefixMatch
-              replacePrefixMatch: /api/pve
+            value: /api/pve
       backendRefs:
         - group: gateway.envoyproxy.io
           kind: Backend
diff --git a/bin/single-node/nginx.conf b/bin/single-node/nginx.conf
index 515a7016da0..c5e500e6670 100644
--- a/bin/single-node/nginx.conf
+++ b/bin/single-node/nginx.conf
@@ -81,6 +81,13 @@ http {
             proxy_send_timeout 1d;
         }
 
+        location /api/pve/ {
+            proxy_pass http://workflow-runtime-coordinator-service:8085;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # nginx prefix locations match by longest prefix
         location /api/ {
             proxy_pass http://dashboard-service:8080;
             proxy_set_header Host $host;
diff --git a/frontend/proxy.config.json b/frontend/proxy.config.json
index f68602e0714..6802ae762c4 100755
--- a/frontend/proxy.config.json
+++ b/frontend/proxy.config.json
@@ -50,18 +50,15 @@
     "secure": false,
     "changeOrigin": true
   },
-  "/api": {
-    "target": "http://localhost:8080",
+  "/api/pve": {
+    "target": "http://localhost:8085",
     "secure": false,
     "changeOrigin": false
   },
-  "/pve": {
-    "target": "http://localhost:8085",
+  "/api": {
+    "target": "http://localhost:8080",
     "secure": false,
-    "changeOrigin": false,
-    "pathRewrite": {
-      "^/pve": "/api/pve"
-    }
+    "changeOrigin": false
   },
   "/wsapi": {
     "target": "http://localhost:8085",
diff --git a/frontend/src/app/workspace/service/virtual-environment/virtual-environment.service.ts b/frontend/src/app/workspace/service/virtual-environment/virtual-environment.service.ts
index d3108e47564..f47cc6b9856 100644
--- a/frontend/src/app/workspace/service/virtual-environment/virtual-environment.service.ts
+++ b/frontend/src/app/workspace/service/virtual-environment/virtual-environment.service.ts
@@ -21,6 +21,7 @@ import { Observable } from "rxjs";
 import { map } from "rxjs/operators";
 import { HttpClient, HttpParams } from "@angular/common/http";
 import { AuthService } from "../../../common/service/user/auth.service";
+import { AppSettings } from "../../../common/app-setting";
 
 export interface PackageResponse {
   system: string[];
@@ -51,12 +52,12 @@ export class WorkflowPveService {
 
   getSystemPackages(cuid: number): Observable<PackageResponse> {
     const params = this.buildBaseParams().set("cuid", cuid.toString());
-    return this.http.get<PackageResponse>("/pve/system", { params });
+    return this.http.get<PackageResponse>(`${AppSettings.getApiEndpoint()}/pve/system`, { params });
   }
 
   fetchPVEs(cuid: number): Observable<PvePackageResponse[]> {
     const params = this.buildBaseParams().set("cuid", cuid.toString());
-    return this.http.get<PvePackageResponse[]>("/pve/pves", { params });
+    return this.http.get<PvePackageResponse[]>(`${AppSettings.getApiEndpoint()}/pve/pves`, { params });
   }
 
   getUserPackages(cuid: number, pveName: string): Observable<string[]> {
@@ -64,14 +65,14 @@ export class WorkflowPveService {
   }
 
   deleteEnvironments(cuid: number) {
-    return this.http.delete(`/pve/pves/${cuid}`);
+    return this.http.delete(`${AppSettings.getApiEndpoint()}/pve/pves/${cuid}`);
   }
 
   deletePackage(cuid: number, pveName: string, packageName: string) {
     const params = this.buildBaseParams();
 
     return this.http.delete<string[]>(
-      `/pve/${cuid}/${encodeURIComponent(pveName)}/packages/${encodeURIComponent(packageName)}`,
+      `${AppSettings.getApiEndpoint()}/pve/${cuid}/${encodeURIComponent(pveName)}/packages/${encodeURIComponent(packageName)}`,
       { params }
     );
   }