diff --git a/apps/dashboard/src/lib/utils/services/api/index.ts b/apps/dashboard/src/lib/utils/services/api/index.ts
index 006df8c3..9320b113 100644
--- a/apps/dashboard/src/lib/utils/services/api/index.ts
+++ b/apps/dashboard/src/lib/utils/services/api/index.ts
@@ -16,7 +16,10 @@ export const getRequestBaseUrl = () => {
     return process.env.PRIVATE_SERVER_URL || env.PUBLIC_SERVER_URL;
   }
 
-  return env.PUBLIC_SERVER_URL;
+  // Browser: same-origin via the Cloudflare Worker /api proxy. Keeps auth
+  // cookies host-only on whichever domain the user is currently visiting
+  // (app.classroomio.com, <org>.classroomio.school, or a BYOD domain).
+  return `${window.location.origin}/api`;
 };
 
 function mergeAbortSignals(...signals: Array<AbortSignal | null | undefined>) {
diff --git a/apps/dashboard/src/lib/utils/services/auth/client.ts b/apps/dashboard/src/lib/utils/services/auth/client.ts
index 39a29184..2e2c873d 100644
--- a/apps/dashboard/src/lib/utils/services/auth/client.ts
+++ b/apps/dashboard/src/lib/utils/services/auth/client.ts
@@ -1,9 +1,12 @@
 import { createAuthClient } from 'better-auth/svelte';
-import { env } from '$env/dynamic/public';
+import { getRequestBaseUrl } from '$lib/utils/services/api';
 import { ssoClient } from '@better-auth/sso/client';
 
+// Server: PRIVATE_SERVER_URL (Render internal). Browser: same-origin /api
+// through the Cloudflare Worker proxy, so auth cookies stay host-only on
+// whichever domain the user is on (app, tenant subdomain, or BYOD).
 export const authClient = createAuthClient({
-  baseURL: env.PUBLIC_SERVER_URL,
+  baseURL: getRequestBaseUrl(),
   fetchOptions: {
     credentials: 'include' // Include cookies in requests
   },