diff --git a/src/auth.ts b/src/auth.ts
index 32eea81..26d0713 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -44,11 +44,10 @@ export const pool = new Pool({
   connectionString: required("AUTH_DATABASE_URL"),
 });
 
+const baseURL = required("BETTER_AUTH_URL");
+
 export const auth = betterAuth({
-  // Public origin incl. the gateway path prefix (e.g. https://host/auth). The
-  // gateway strips /auth before forwarding, so Better Auth's own routing uses
-  // its default basePath while generated URLs/issuer keep the /auth prefix.
-  baseURL: required("BETTER_AUTH_URL"),
+  baseURL,
   secret: required("BETTER_AUTH_SECRET"),
   logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
@@ -64,10 +63,12 @@ export const auth = betterAuth({
     // unauthenticated variant is required because MCP clients register before
     // they have any credentials.
     oauthProvider({
-      loginPage: "/login",
+      // Absolute URL: some OAuth clients resolve a relative login redirect
+      // against their own origin, landing on a blank page.
+      loginPage: `${baseURL}/login`,
       // Required by the type; not shown because skipConsent auto-approves — for
       // a personal MCP connector, signing in *is* the authorization.
-      consentPage: "/consent",
+      consentPage: `${baseURL}/consent`,
       skipConsent: true,
       allowDynamicClientRegistration: true,
       allowUnauthenticatedClientRegistration: true,