diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 4e59173..8cadc70 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -158,6 +158,10 @@ jobs:
             --resource-group "$AZURE_RESOURCE_GROUP" \
             --query          "properties.configuration.ingress.fqdn" \
             --output         tsv)
+          if [[ -z "$FQDN" ]]; then
+            echo "::error::Backend FQDN is empty — check BACKEND_APP_NAME secret"
+            exit 1
+          fi
           echo "backend_url=https://${FQDN}" >> "$GITHUB_OUTPUT"
           echo "Backend: https://${FQDN}"
 
@@ -200,6 +204,28 @@ jobs:
           tenant-id:       ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
+      - name: Resolve backend URL
+        id: backend-url
+        shell: bash
+        run: |
+          set -euo pipefail
+          URL="${{ needs.deploy-backend.outputs.backend_url }}"
+          if [[ -z "$URL" || "$URL" == "https://" ]]; then
+            echo "::warning::backend_url job output empty — resolving from Azure (common when re-running only deploy-frontend)"
+            FQDN=$(az containerapp show \
+              --name           "$BACKEND_APP_NAME" \
+              --resource-group "$AZURE_RESOURCE_GROUP" \
+              --query          "properties.configuration.ingress.fqdn" \
+              --output         tsv)
+            if [[ -z "$FQDN" ]]; then
+              echo "::error::Cannot resolve backend FQDN — check BACKEND_APP_NAME and AZURE_RESOURCE_GROUP secrets"
+              exit 1
+            fi
+            URL="https://${FQDN}"
+          fi
+          echo "backend_url=${URL}" >> "$GITHUB_OUTPUT"
+          echo "Using backend URL: ${URL}"
+
       - name: Set image URI (ghcr.io requires lowercase)
         shell: bash
         run: |
@@ -232,14 +258,14 @@ jobs:
           tags:       ${{ env.FRONTEND_IMAGE }}
           build-args: |
             VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }}
-            VITE_API_BASE_URL=${{ needs.deploy-backend.outputs.backend_url }}
+            VITE_API_BASE_URL=${{ steps.backend-url.outputs.backend_url }}
             VITE_PUBLIC_SITE_URL=${{ secrets.FRONTEND_URL != '' && secrets.FRONTEND_URL || secrets.VITE_PUBLIC_SITE_URL }}
 
       - name: Configure GHCR pull + deploy frontend image
         shell: bash
         env:
           GHCR_PASSWORD: ${{ secrets.GHCR_READ_TOKEN }}
-          BACKEND_URL: ${{ needs.deploy-backend.outputs.backend_url }}
+          BACKEND_URL: ${{ steps.backend-url.outputs.backend_url }}
         run: |
           set -euo pipefail
           if [[ -z "${GHCR_PASSWORD}" ]]; then