diff --git a/app/api/auth/callback/google/route.ts b/app/api/auth/callback/google/route.ts
index 7084e85..f85e51b 100644
--- a/app/api/auth/callback/google/route.ts
+++ b/app/api/auth/callback/google/route.ts
@@ -39,7 +39,7 @@ function getOrigin(req?: Request): string {
       return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }
 
 export async function GET(request: Request) {
diff --git a/app/api/auth/google/route.ts b/app/api/auth/google/route.ts
index f2384e6..b5b2531 100644
--- a/app/api/auth/google/route.ts
+++ b/app/api/auth/google/route.ts
@@ -52,5 +52,5 @@ function getOrigin(req?: Request): string {
       return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }
\ No newline at end of file
diff --git a/infrastructure/auth/google-oauth.ts b/infrastructure/auth/google-oauth.ts
index 7390815..f032b1c 100644
--- a/infrastructure/auth/google-oauth.ts
+++ b/infrastructure/auth/google-oauth.ts
@@ -11,15 +11,20 @@ export function isGoogleOAuthConfigured(): boolean {
 export function getSiteOrigin(req?: Request): string {
   if (req) {
     try {
-      const url = new URL(req.url);
-      // In production behind nginx, prefer https even if internal request is http
-      if (process.env.NODE_ENV === 'production' && url.protocol === 'http:') {
-        url.protocol = 'https:';
+      const h = req.headers;
+      const host = h.get('x-forwarded-host') || h.get('host');
+      let proto = h.get('x-forwarded-proto') || 'https';
+      if (proto.includes(',')) proto = proto.split(',')[0].trim();
+      if (host) {
+        // ensure https in prod
+        if (process.env.NODE_ENV === 'production' && proto === 'http') {
+          proto = 'https';
+        }
+        return `${proto}://${host}`;
       }
-      return url.origin;
     } catch {}
   }
-  return process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000';
+  return process.env.NEXT_PUBLIC_SITE_URL ?? 'https://shahikitchen.se';
 }
 
 export function getGoogleRedirectUri(req?: Request): string {