diff --git a/apps/web/Dockerfile b/apps/web/Dockerfile
index ffaf88a..2454dba 100644
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@@ -14,6 +14,7 @@ COPY --from=deps /app/ ./
 COPY apps/web/ ./apps/web/
 COPY packages/shared/ ./packages/shared/
 COPY tsconfig.base.json ./
+ENV NEXT_PUBLIC_API_URL=/api-proxy
 RUN pnpm --filter=@tessera/web build
 
 FROM node:24-alpine AS runner
diff --git a/apps/web/next.config.ts b/apps/web/next.config.ts
index ef8eb08..069d6c0 100644
--- a/apps/web/next.config.ts
+++ b/apps/web/next.config.ts
@@ -5,6 +5,15 @@ const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts');
 
 const nextConfig: NextConfig = {
   output: 'standalone' as const,
+  async rewrites() {
+    const apiUrl = process.env.API_INTERNAL_URL || 'http://localhost:3001';
+    return [
+      {
+        source: '/api-proxy/:path*',
+        destination: `${apiUrl}/:path*`,
+      },
+    ];
+  },
 };
 
 export default withNextIntl(nextConfig);
diff --git a/apps/web/src/lib/api.ts b/apps/web/src/lib/api.ts
index 1c98117..0ce56e3 100644
--- a/apps/web/src/lib/api.ts
+++ b/apps/web/src/lib/api.ts
@@ -5,7 +5,7 @@
  * All functions accept a cookie string for server-side auth forwarding.
  */
 
-const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
+const API_URL = process.env.API_INTERNAL_URL || process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';
 
 /**
  * Module data shape from the API.
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index c18709d..59fc70f 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -6,7 +6,7 @@ services:
       - "3000:3000"
     environment:
       HOSTNAME: "0.0.0.0"
-      NEXT_PUBLIC_API_URL: ${APP_URL:-http://localhost:3001}
+      NEXT_PUBLIC_API_URL: http://api:3001
       API_INTERNAL_URL: "http://api:3001"
       JWT_SECRET: ${JWT_SECRET}
     networks: