diff --git a/controllers/degreeController.js b/controllers/degreeController.js
index b3eb5ea..f95b63d 100644
--- a/controllers/degreeController.js
+++ b/controllers/degreeController.js
@@ -189,7 +189,7 @@ exports.destroy = async (req, res) => {
 
 function buildSecureUrl(req, filename) {
   if (!filename) return undefined;
-  const baseUrl = `${req.protocol}://${req.get('host')}`;
+  const baseUrl = process.env.BACKEND_URL ?? `${req.protocol}://${req.get('host')}`;
   const name = path.basename(filename);
   return `${baseUrl}/secure-files/${name}?api_key=${req.query.api_key}`;
 }
diff --git a/utils/imageHelper.js b/utils/imageHelper.js
index a894130..bdbebff 100644
--- a/utils/imageHelper.js
+++ b/utils/imageHelper.js
@@ -5,7 +5,7 @@
  */
 function addBaseUrlToImages(data, baseUrl) {
   // Use passed baseUrl, then env var, then default to localhost:3001
-  const BACKEND_URL = (baseUrl || process.env.BACKEND_URL || "http://localhost:3001").replace(/\/$/, "");
+  const BACKEND_URL = (baseUrl ?? process.env.BACKEND_URL ?? "http://localhost:3001").replace(/\/$/, "");
 
   // Tạo bản sao sâu để tránh thay đổi dữ liệu gốc
   const processedData = JSON.parse(JSON.stringify(data));