diff --git a/config/platform-infra/nginx.yaml b/config/platform-infra/nginx.yaml
index 026b94d5..1f1ad5fd 100644
--- a/config/platform-infra/nginx.yaml
+++ b/config/platform-infra/nginx.yaml
@@ -22,6 +22,8 @@ artifacts:
     sha256: c0ef2e286ba1c45bf1868b70a1c71d30a802bb3996888f2f986c3166f9e45f57
   distribution:
     route: NC01
+    imagePath: /opt/unidesk/artifacts/nginx/nginx-lb-logger-1.0.0.tar.gz
+    composePluginPath: /usr/libexec/docker/cli-plugins/docker-compose
     workDir: /tmp/unidesk-nginx-artifacts
     bindHost: 0.0.0.0
     port: 19191
diff --git a/scripts/src/platform-infra-nginx.ts b/scripts/src/platform-infra-nginx.ts
index 84df3b8b..f13c6b25 100644
--- a/scripts/src/platform-infra-nginx.ts
+++ b/scripts/src/platform-infra-nginx.ts
@@ -36,6 +36,8 @@ interface ImageArtifact extends Artifact {
 
 interface ArtifactDistribution {
   route: string;
+  imagePath: string;
+  composePluginPath: string;
   workDir: string;
   bindHost: string;
   port: number;
@@ -145,6 +147,8 @@ function readConfig(): NginxConfig {
 
 function validateDistribution(distribution: ArtifactDistribution): void {
   simpleName(distribution.route, "artifacts.distribution.route");
+  absolutePath(distribution.imagePath, "artifacts.distribution.imagePath");
+  absolutePath(distribution.composePluginPath, "artifacts.distribution.composePluginPath");
   absolutePath(distribution.workDir, "artifacts.distribution.workDir");
   assert(distribution.bindHost === "0.0.0.0", "artifacts.distribution.bindHost must be 0.0.0.0");
   port(distribution.port, "artifacts.distribution.port");
@@ -289,8 +293,6 @@ async function apply(config: UniDeskConfig, options: OpsApplyOptions): Promise<R
   const distributedImage = `${distribution.workDir}/${fileName(nginx.artifacts.image.remotePath)}`;
   const distributedPlugin = `${distribution.workDir}/${fileName(nginx.artifacts.composePlugin.remotePath)}`;
   const uploads = [
-    uploadArtifact(distribution.route, nginx.artifacts.image.localPath, distributedImage),
-    uploadArtifact(distribution.route, nginx.artifacts.composePlugin.localPath, distributedPlugin),
     uploadArtifact(target.route, secret.sourcePath, target.runtime.envPath),
   ];
   const failedUpload = uploads.find((upload) => !upload.ok);
@@ -305,7 +307,12 @@ async function apply(config: UniDeskConfig, options: OpsApplyOptions): Promise<R
       apiKey: secretSummary(target, secret),
     };
   }
-  const source = await capture(config, distribution.route, ["sh"], startArtifactSourceScript(distribution));
+  const source = await capture(
+    config,
+    distribution.route,
+    ["sh"],
+    startArtifactSourceScript(nginx),
+  );
   if (source.exitCode !== 0) {
     await capture(config, distribution.route, ["sh"], stopArtifactSourceScript(distribution));
     return failedApply(id, target, "artifact-source", source, secret);
@@ -362,9 +369,20 @@ install -d -m 0755 ${shQuote(target.runtime.workDir)} ${shQuote(target.runtime.l
 `;
 }
 
-function startArtifactSourceScript(distribution: ArtifactDistribution): string {
+function startArtifactSourceScript(config: NginxConfig): string {
+  const distribution = config.artifacts.distribution;
+  const imageLink = `${distribution.workDir}/${fileName(config.artifacts.image.remotePath)}`;
+  const pluginLink = `${distribution.workDir}/${fileName(config.artifacts.composePlugin.remotePath)}`;
   return `set -eu
 dir=${shQuote(distribution.workDir)}
+rm -rf "$dir"
+install -d -m 0755 "$dir"
+[ "$(sha256sum ${shQuote(distribution.imagePath)} | awk '{print $1}')" = \
+  ${shQuote(config.artifacts.image.sha256)} ]
+[ "$(sha256sum ${shQuote(distribution.composePluginPath)} | awk '{print $1}')" = \
+  ${shQuote(config.artifacts.composePlugin.sha256)} ]
+ln -s ${shQuote(distribution.imagePath)} ${shQuote(imageLink)}
+ln -s ${shQuote(distribution.composePluginPath)} ${shQuote(pluginLink)}
 pid_file="$dir/server.pid"
 [ ! -f "$pid_file" ] || kill "$(cat "$pid_file")" 2>/dev/null || true
 nohup python3 -m http.server ${distribution.port} --bind ${shQuote(distribution.bindHost)} \