diff --git a/deploy/scripts/test-generate.sh b/deploy/scripts/test-generate.sh
index 76c984e..6455cfe 100755
--- a/deploy/scripts/test-generate.sh
+++ b/deploy/scripts/test-generate.sh
@@ -423,6 +423,26 @@ else
   bad "Nessie host-facing: port bisa salah untuk Nessie eksternal (beh='${_nr_beh}')"
 fi
 
+# ─── 0r2. S3 host-facing: port dari S3_ENDPOINT (mis. :8443) lewat sicabe_host_url ─
+# Regresi: verify-phase2 membentuk host_ep via sicabe_local_url(MINIO_HOST,MINIO_PORT)
+# → S3 eksternal ber-URL penuh (https://minio-api.sicabe.com:8443) diprobe di :12900.
+_sr2=1
+grep -q 'sicabe_host_url S3_ENDPOINT MINIO_HOST' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" || _sr2=0
+grep -q 'sicabe_local_url "${S3_SCHEME:-http}" MINIO_HOST' "${DEPLOY_DIR}/scripts/verify-phase2-storage.sh" && _sr2=0
+_sr2_beh="$(bash -c '
+  # shellcheck disable=SC1091
+  source "'"${DEPLOY_DIR}"'/lib/common.sh" >/dev/null 2>&1 || exit 9
+  MINIO_HOST=localhost MINIO_PORT=12900 S3_SCHEME=https
+  S3_ENDPOINT=https://minio-api.sicabe.com:8443; a="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "$MINIO_PORT" "$S3_SCHEME")"
+  S3_ENDPOINT=http://minio:9000; b="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "$MINIO_PORT" http)"
+  printf "%s|%s" "$a" "$b"' 2>/dev/null)"
+[[ "${_sr2_beh}" == "https://minio-api.sicabe.com:8443|http://localhost:12900" ]] || _sr2=0
+if [[ "${_sr2}" == "1" ]]; then
+  ok "S3 host-facing: pakai sicabe_host_url (URL penuh → apa adanya; nama service → host:port terbit)"
+else
+  bad "S3 host-facing: port bisa salah untuk S3 eksternal ber-URL penuh (beh='${_sr2_beh}')"
+fi
+
 # ─── 0s. Realm Keycloak Trino terparameter (SICABE_REALM, bukan literal `sicabe`) ─
 # Regresi: issuer/auth/token/jwks Trino dipatok `/realms/sicabe` → client ber-realm lain
 # (SICABE_REALM != sicabe) tetap diarahkan ke realm `sicabe` → OIDC gagal.
diff --git a/deploy/scripts/verify-phase2-storage.sh b/deploy/scripts/verify-phase2-storage.sh
index c24fdec..50871e0 100755
--- a/deploy/scripts/verify-phase2-storage.sh
+++ b/deploy/scripts/verify-phase2-storage.sh
@@ -125,7 +125,10 @@ check_object_storage() {
   # S3_ENDPOINT umumnya hanya terjangkau dari jaringan Docker (mis.
   # http://minio:9000) → uji keterjangkauan dilakukan dari container (uji mc).
   # Di host kita cek port publik MinIO saja (informatif, bukan gate).
-  local host_ep="$(sicabe_local_url "${S3_SCHEME:-http}" MINIO_HOST "${MINIO_PORT:-12900}")"
+  # Bila S3_ENDPOINT berupa ALAMAT (IP/FQDN, mis. https://minio-api.sicabe.com:8443),
+  # pakai APA ADANYA — termasuk port-nya — lewat sicabe_host_url. Tanpa ini, URL
+  # penuh diprobe di port terbit lokal (12900) → WARN palsu.
+  local host_ep="$(sicabe_host_url S3_ENDPOINT MINIO_HOST "${MINIO_PORT:-12900}" "${S3_SCHEME:-http}")"
   local host_code
   host_code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 8 \
     "${host_ep}/minio/health/live" 2>/dev/null || true)