diff --git a/src/app/auth/confirm/route.ts b/src/app/auth/confirm/route.ts
index 4355ea2..610ae77 100644
--- a/src/app/auth/confirm/route.ts
+++ b/src/app/auth/confirm/route.ts
@@ -1,6 +1,7 @@
 import { NextResponse, type NextRequest } from "next/server";
 import { z } from "zod";
 
+import { serverEnv } from "@/lib/env.server";
 import { createClient } from "@/lib/supabase/server";
 
 const otpTypeSchema = z.enum(["magiclink", "email", "signup", "invite", "recovery", "email_change"]);
@@ -23,8 +24,9 @@ export async function GET(request: NextRequest) {
     signedIn = !error;
   }
 
-  const url = request.nextUrl.clone();
-  url.pathname = signedIn ? "/admin" : "/login";
-  url.search = signedIn ? "" : "?error=link";
-  return NextResponse.redirect(url);
+  // Built from the configured site URL, not request.nextUrl: behind a reverse proxy or
+  // tunnel a route handler sees the address the server is bound to (e.g. localhost:4322),
+  // and redirecting there leaves the session cookie behind on the public domain.
+  const path = signedIn ? "/admin" : "/login?error=link";
+  return NextResponse.redirect(`${serverEnv.NEXT_PUBLIC_SITE_URL}${path}`);
 }