diff --git a/app-hooks/post-installation/00-setup-trusted-domains.sh b/app-hooks/post-installation/00-setup-trusted-domains.sh
index 7a219ea..b31b499 100755
--- a/app-hooks/post-installation/00-setup-trusted-domains.sh
+++ b/app-hooks/post-installation/00-setup-trusted-domains.sh
@@ -4,8 +4,7 @@ set -euox pipefail
 
 php /var/www/html/occ config:system:set trusted_domains 2 --value=host.docker.internal
 
-# Set overwrite settings for URL generation (needed for OIDC discovery to return correct URLs)
-# These ensure that URLs generated by Nextcloud include the correct host:port
-php /var/www/html/occ config:system:set overwritehost --value="localhost:8080"
-php /var/www/html/occ config:system:set overwriteprotocol --value="http"
-php /var/www/html/occ config:system:set overwrite.cli.url --value="http://localhost:8080"
+# Do NOT set overwritehost/overwrite.cli.url - let Nextcloud use the request's Host header
+# This allows:
+# - Browser requests to localhost:8080 → returns localhost:8080 URLs
+# - Container requests to app:80 → returns app:80 URLs (for DCR, token exchange, etc.)