diff --git a/lib/common.sh b/lib/common.sh
index 4c54ad7..b339004 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -856,6 +856,7 @@ configure_caddy_for_service() {
     # already the only intended way in, instead of leaving both routes open.
     CADDY_SERVICE_CONFIGURED=false
     CADDY_SERVICE_MODE=""
+    CADDY_SERVICE_DOMAIN=""
 
     # Derive the proxy upstream and a port number for display messages.
     # Plain number  → host.docker.internal:PORT  (host-network or legacy
@@ -916,6 +917,15 @@ configure_caddy_for_service() {
     if [ -z "$SERVICE_DOMAIN" ]; then
         echo "  ⚠ No domain provided, skipping Caddy configuration."; return 0
     fi
+    # Set as soon as we know a domain was actually accepted — every path below
+    # this point that returns 0 without configuring Caddy is a genuine failure
+    # (write/reload error), not "no domain chosen", so leaving this set is
+    # correct: the caller can tell CADDY_SERVICE_CONFIGURED apart from whether
+    # a domain was entered at all. Callers that pre-compute their own default
+    # URL/domain before calling this (e.g. services/mealie.sh's BASE_URL) need
+    # this to reconcile against whatever the user actually typed here, which
+    # can differ from that pre-computed default.
+    CADDY_SERVICE_DOMAIN="$SERVICE_DOMAIN"
 
     # Build the site block — upstream differs by mode
     local _BLOCK_UPSTREAM="$_UPSTREAM"
diff --git a/services/mealie.sh b/services/mealie.sh
index ffb9baa..52ecd86 100644
--- a/services/mealie.sh
+++ b/services/mealie.sh
@@ -442,6 +442,22 @@ MEALIE_ENV
 
     configure_caddy_for_service "Mealie${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}" "${CONTAINER}:9000" "recipes${INSTANCE_SUFFIX:+-$INSTANCE_SUFFIX}"
 
+    # The domain typed at that prompt can differ from the recipes.<domain>
+    # default BASE_URL was already set to above (e.g. the user overrides it
+    # with a different subdomain). Reconcile BASE_URL to match whatever
+    # Caddy actually ended up fronting, since BASE_URL is what gets
+    # registered as the OIDC redirect URI just below — a stale BASE_URL
+    # there means Authelia rejects every login with "redirect_uri does not
+    # match any of the OAuth 2.0 Client's pre-registered redirect_uris" even
+    # though Caddy and DNS both point at the right place. Confirmed live:
+    # this is exactly what happened when the Caddy prompt was answered with
+    # a different subdomain than the auto-generated default.
+    if [ "$CADDY_SERVICE_CONFIGURED" = true ] && [ -n "$CADDY_SERVICE_DOMAIN" ] && [ "$MEALIE_BASE_URL" != "https://${CADDY_SERVICE_DOMAIN}" ]; then
+        MEALIE_BASE_URL="https://${CADDY_SERVICE_DOMAIN}"
+        sed -i "s#^BASE_URL=.*#BASE_URL=${MEALIE_BASE_URL}#" .env
+        log_info "BASE_URL updated to match the domain just configured: $MEALIE_BASE_URL"
+    fi
+
     declare -F _mealie_offer_authelia_oidc >/dev/null 2>&1 && _mealie_offer_authelia_oidc "$MEALIE_DIR" "$CONTAINER"
 
     write_readme "$MEALIE_DIR" << MD