diff --git a/.env.example b/.env.example
index 6ce7b3d..b3cc8fb 100644
--- a/.env.example
+++ b/.env.example
@@ -19,6 +19,8 @@ WATCH_DIR=""
 
 # Auth.js (required — generate with: npx auth secret)
 AUTH_SECRET=""
+# Set AUTH_URL to your external URL when behind a reverse proxy
+AUTH_URL="https://staging.echoocr.stillwell.cloud"
 
 # Authentik OIDC SSO (optional — enables "Sign in with SSO" button)
 # Create an OAuth2/OIDC provider in Authentik and set these values.
diff --git a/src/auth.ts b/src/auth.ts
index 17d462d..33b162c 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -7,6 +7,7 @@ import { prisma } from "@/lib/db";
 export const { handlers, auth, signIn, signOut } = NextAuth({
   adapter: PrismaAdapter(prisma),
   session: { strategy: "jwt" },
+  trustHost: true,
   pages: {
     signIn: "/login",
   },