diff --git a/app/api/account/verify-email/route.ts b/app/api/account/verify-email/route.ts
index e83e320..eb45a5f 100644
--- a/app/api/account/verify-email/route.ts
+++ b/app/api/account/verify-email/route.ts
@@ -4,12 +4,20 @@ import { verifyEmailByToken } from "../../../lib/customerAuth";
 // Entered from the link in the verification email — no session exists
 // yet at this point. See Customers.ts's own comment on why this is a
 // non-blocking flag (login already works before this is ever clicked).
+//
+// Base URL is deliberately NOT built from request.url — behind Caddy's
+// reverse proxy that reflects the container's internal address
+// (0.0.0.0:3000, confirmed live), not the public domain, and would send a
+// real browser to an unreachable address. Same hardcoded-origin approach
+// as Customers.ts's own FRONTEND_URL default on the Payload side.
+const SITE_URL = "https://einfach-produktiv.mk360.de";
+
 export async function GET(request: NextRequest) {
   const token = request.nextUrl.searchParams.get("token");
   if (!token) return new Response("Ungültiger Link.", { status: 400 });
 
   const ok = await verifyEmailByToken(token);
-  const url = new URL("/konto/profil", request.url);
+  const url = new URL("/konto/profil", SITE_URL);
   url.searchParams.set("verified", ok ? "1" : "0");
   return NextResponse.redirect(url);
 }