diff --git a/app/config.yaml b/app/config.yaml
index d0e67f4..455c6ee 100644
--- a/app/config.yaml
+++ b/app/config.yaml
@@ -19,6 +19,7 @@ authelia:
   users_db_path: "/opt/authelia/users_database.yml"
 
 oidc:
+  issuer_url: "https://auth.sechpoint.app"
   client_id: "nextwks"
   client_secret: ""
   redirect_url: "https://wks.lohmar.co.uk/auth/callback"
diff --git a/install.sh b/install.sh
index 2214a44..1b6a527 100755
--- a/install.sh
+++ b/install.sh
@@ -240,6 +240,7 @@ authelia:
   users_db_path: "/opt/authelia/users_database.yml"
 
 oidc:
+  issuer_url: "https://auth.sechpoint.app"
   client_id: "nextwks"
   client_secret: ""
   redirect_url: "https://wks.lohmar.co.uk/auth/callback"
diff --git a/src/core/config/config.go b/src/core/config/config.go
index c977b8b..4999412 100644
--- a/src/core/config/config.go
+++ b/src/core/config/config.go
@@ -40,6 +40,7 @@ type AutheliaConfig struct {
 
 // OIDCConfig holds the OIDC provider settings (Authelia).
 type OIDCConfig struct {
+	IssuerURL    string `yaml:"issuer_url"` // Public-facing URL users reach (e.g., https://auth.sechpoint.app)
 	ClientID     string `yaml:"client_id"`
 	ClientSecret string `yaml:"client_secret"`
 	RedirectURL  string `yaml:"redirect_url"`
diff --git a/src/main.go b/src/main.go
index 5035209..c361f77 100644
--- a/src/main.go
+++ b/src/main.go
@@ -65,8 +65,15 @@ func main() {
 
 	// Initialize session store and OIDC auth
 	sessionStore := auth.NewSessionStore(database.DB)
+
+	// OIDC issuer: public-facing URL (via Zoraxy) for browser redirects
+	// Falls back to authelia.host if not configured
+	issuerURL := cfg.OIDC.IssuerURL
+	if issuerURL == "" {
+		issuerURL = cfg.Authelia.Host
+	}
 	oidcCfg := auth.OIDCConfig{
-		IssuerURL:    cfg.Authelia.Host,
+		IssuerURL:    issuerURL,
 		ClientID:     cfg.OIDC.ClientID,
 		ClientSecret: cfg.OIDC.ClientSecret,
 		RedirectURL:  cfg.OIDC.RedirectURL,