diff --git a/src/app/api/auth/callback/route.ts b/src/app/api/auth/callback/route.ts
index f372e40..a4edcbd 100644
--- a/src/app/api/auth/callback/route.ts
+++ b/src/app/api/auth/callback/route.ts
@@ -74,12 +74,10 @@ export async function GET(request: NextRequest) {
     payload: { username: userinfo.preferred_username, displayName: userinfo.name, role: user.role },
   })
 
-  // 使用 nginx 转发的 Host 头构造正确的公共 URL
-  const proto = request.headers.get('x-forwarded-proto') || 'http'
-  const host = request.headers.get('x-forwarded-host') || request.headers.get('host') || request.nextUrl.host
-  const publicUrl = `${proto}://${host}`
+  // 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
+  const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
 
-  const response = NextResponse.redirect(new URL('/', publicUrl))
+  const response = NextResponse.redirect(new URL('/', baseUrl))
 
   // 签发 tlyq_session cookie
   response.cookies.set('tlyq_session', token, {