diff --git a/deploy.sh b/deploy.sh
index 686f9a0..efba771 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -186,6 +186,12 @@ ZORAXY_DNS
 
     echo "[OK] ZorxAuth SSO configured"
 
+    # --- Fix SSO redirect URL in BoltDB (API may not persist it correctly) ---
+    echo "[*] Ensuring SSO redirect URL is set in BoltDB..."
+    go build -o /tmp/fix-zoraxy-sso ./tools/fix-zoraxy-sso/
+    sudo /tmp/fix-zoraxy-sso /opt/nextworkspace/config/zoraxy/sys.db 2>&1 || echo "[WARN] SSO BoltDB fix failed (non-fatal)"
+    rm -f /tmp/fix-zoraxy-sso
+
     # --- Generate launcher apps.yaml with actual domain ---
     cat > "$TARGET_DIR/config/nextworkspace/apps.yaml" <<EOF
 apps:
diff --git a/go.mod b/go.mod
index 382f199..e3555cf 100644
--- a/go.mod
+++ b/go.mod
@@ -3,3 +3,8 @@ module nextworkspace
 go 1.25.0
 
 require gopkg.in/yaml.v3 v3.0.1
+
+require (
+	go.etcd.io/bbolt v1.5.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+)
diff --git a/go.sum b/go.sum
index a62c313..75f9ac3 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,7 @@
+go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
+go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/tools/fix-zoraxy-sso/main.go b/tools/fix-zoraxy-sso/main.go
new file mode 100644
index 0000000..9c00df7
--- /dev/null
+++ b/tools/fix-zoraxy-sso/main.go
@@ -0,0 +1,68 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+
+	"go.etcd.io/bbolt"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		fmt.Fprintf(os.Stderr, "Usage: fix-zoraxy-sso <db-path>\n")
+		os.Exit(1)
+	}
+
+	dbPath := os.Args[1]
+	bucket := "zorxauth"
+	key := "options"
+
+	db, err := bbolt.Open(dbPath, 0600, nil)
+	if err != nil {
+		log.Fatalf("Failed to open DB %s: %v", dbPath, err)
+	}
+	defer db.Close()
+
+	err = db.Update(func(tx *bbolt.Tx) error {
+		b := tx.Bucket([]byte(bucket))
+		if b == nil {
+			return fmt.Errorf("bucket %q not found", bucket)
+		}
+
+		val := b.Get([]byte(key))
+		if val == nil {
+			return fmt.Errorf("key %q not found in bucket %q", key, bucket)
+		}
+
+		var opts map[string]interface{}
+		if err := json.Unmarshal(val, &opts); err != nil {
+			return fmt.Errorf("failed to parse JSON: %v", err)
+		}
+
+		// Update the critical SSO fields
+		opts["sso_redirect_url"] = fmt.Sprintf("https://app.%s/", getDomain())
+		opts["enable_auth_gateway"] = true
+
+		updated, err := json.Marshal(opts)
+		if err != nil {
+			return fmt.Errorf("failed to marshal JSON: %v", err)
+		}
+
+		return b.Put([]byte(key), updated)
+	})
+
+	if err != nil {
+		log.Fatalf("Update failed: %v", err)
+	}
+
+	fmt.Println("[OK] ZorxAuth SSO config updated in BoltDB")
+}
+
+func getDomain() string {
+	if d := os.Getenv("DOMAIN"); d != "" {
+		return d
+	}
+	return "nextwks.eu"
+}