diff --git a/src/dotnet/QuantEngine.Web/Client/Infrastructure/CustomAuthenticationStateProvider.cs b/src/dotnet/QuantEngine.Web/Client/Infrastructure/CustomAuthenticationStateProvider.cs
index c11f468..772c040 100644
--- a/src/dotnet/QuantEngine.Web/Client/Infrastructure/CustomAuthenticationStateProvider.cs
+++ b/src/dotnet/QuantEngine.Web/Client/Infrastructure/CustomAuthenticationStateProvider.cs
@@ -42,9 +42,10 @@ namespace QuantEngine.Web.Client.Infrastructure
                 try
                 {
                     Console.WriteLine("[Auth] Attempting validation via /api/auth/me (cookie or Bearer)...");
-                    var baseUrl = _http.BaseAddress?.AbsoluteUri ?? "http://localhost:5265";
-                    var meUrl = new Uri(new Uri(baseUrl), "api/auth/me").ToString();
-                    Console.WriteLine($"[Auth] /api/auth/me URL: {meUrl}");
+                    // BaseAddress is always set to HostEnvironment.BaseAddress by DI.
+                    // Never fall back to a hardcoded port — it breaks in production.
+                    var meUrl = "api/auth/me";
+                    Console.WriteLine($"[Auth] /api/auth/me URL: {_http.BaseAddress}{meUrl}");
 
                     var meResponse = await _http.GetAsync(meUrl);
                     Console.WriteLine($"[Auth] /api/auth/me status: {meResponse.StatusCode}");
diff --git a/src/dotnet/QuantEngine.Web/Client/Pages/Users.razor b/src/dotnet/QuantEngine.Web/Client/Pages/Users.razor
index e5b9d98..c4fec35 100644
--- a/src/dotnet/QuantEngine.Web/Client/Pages/Users.razor
+++ b/src/dotnet/QuantEngine.Web/Client/Pages/Users.razor
@@ -136,10 +136,8 @@
     {
         try
         {
-            if (Http.BaseAddress == null)
-            {
-                Http.BaseAddress = new Uri("http://localhost:5265/");
-            }
+            // BaseAddress is set to HostEnvironment.BaseAddress by DI in Client/Program.cs.
+            // Never override it with a hardcoded port.
             var res = await Http.GetFromJsonAsync<List<UserDto>>("api/users");
             if (res != null)
             {
diff --git a/src/dotnet/QuantEngine.Web/Client/Services/ApiClient.cs b/src/dotnet/QuantEngine.Web/Client/Services/ApiClient.cs
index 18bb856..d6753c9 100644
--- a/src/dotnet/QuantEngine.Web/Client/Services/ApiClient.cs
+++ b/src/dotnet/QuantEngine.Web/Client/Services/ApiClient.cs
@@ -11,9 +11,13 @@ public class ApiClient
     public ApiClient(HttpClient http, ILogger<ApiClient> logger)
     {
         _http = http;
+        // BaseAddress is set by the DI registration in Client/Program.cs via
+        // builder.HostEnvironment.BaseAddress — never hardcode a port here.
         if (_http.BaseAddress == null)
         {
-            _http.BaseAddress = new Uri("http://localhost:5265/");
+            throw new InvalidOperationException(
+                "ApiClient: HttpClient.BaseAddress is null. " +
+                "Ensure the HttpClient is registered with HostEnvironment.BaseAddress in Client/Program.cs.");
         }
         _logger = logger;
     }