diff --git a/server/src/__tests__/better-auth.test.ts b/server/src/__tests__/better-auth.test.ts
index 0029519563d..53718076f4b 100644
--- a/server/src/__tests__/better-auth.test.ts
+++ b/server/src/__tests__/better-auth.test.ts
@@ -112,13 +112,14 @@ describe("Better Auth cookie scoping", () => {
     } as Parameters<typeof shouldDisableSecureAuthCookies>[0])).toBe(false);
   });
 
-  it("lets PAPERCLIP_PUBLIC_URL override the auth base URL for cookie security", () => {
-    process.env.PAPERCLIP_PUBLIC_URL = "http://paperclip-dev:46259";
+  it("uses the caller-resolved public URL for cookie security", () => {
+    process.env.PAPERCLIP_PUBLIC_URL = "https://ignored.example.test";
 
     expect(shouldDisableSecureAuthCookies({
       deploymentMode: "authenticated",
       authBaseUrlMode: "explicit",
       authPublicBaseUrl: "https://paperclip.example.test",
+      publicUrl: "http://paperclip-dev:46259",
     } as Parameters<typeof shouldDisableSecureAuthCookies>[0])).toBe(true);
   });
 
diff --git a/server/src/auth/better-auth.ts b/server/src/auth/better-auth.ts
index 69b8e059733..f7742b9778b 100644
--- a/server/src/auth/better-auth.ts
+++ b/server/src/auth/better-auth.ts
@@ -53,7 +53,6 @@ export function shouldDisableSecureAuthCookies(input: {
 }): boolean {
   const publicUrl = (
     input.publicUrl?.trim() ||
-    process.env.PAPERCLIP_PUBLIC_URL?.trim() ||
     (input.authBaseUrlMode === "explicit" ? input.authPublicBaseUrl?.trim() : "")
   );
   if (publicUrl) return publicUrl.startsWith("http://");
@@ -115,6 +114,7 @@ export function deriveAuthTrustedOrigins(config: Config, opts?: { listenPort?: n
 
 export function createBetterAuthInstance(db: Db, config: Config, trustedOrigins: string[]): BetterAuthInstance {
   const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined;
+  const publicUrl = process.env.PAPERCLIP_PUBLIC_URL?.trim() || baseUrl;
   const secret = process.env.BETTER_AUTH_SECRET ?? process.env.PAPERCLIP_AGENT_JWT_SECRET;
   if (!secret) {
     throw new Error(
@@ -127,7 +127,7 @@ export function createBetterAuthInstance(db: Db, config: Config, trustedOrigins:
     deploymentExposure: config.deploymentExposure,
     authBaseUrlMode: config.authBaseUrlMode,
     authPublicBaseUrl: config.authPublicBaseUrl,
-    publicUrl: process.env.PAPERCLIP_PUBLIC_URL ?? baseUrl,
+    publicUrl,
   });
 
   const authConfig = {