diff --git a/controllers/certificateController.js b/controllers/certificateController.js
index d5f3b0c..7d39082 100644
--- a/controllers/certificateController.js
+++ b/controllers/certificateController.js
@@ -141,7 +141,7 @@ exports.apiVerify = async (req, res) => {
     if (!cert) return res.status(404).json({ error: 'Certificate not found' });
     if (cert.status === 'revoked') return res.status(404).json({ error: 'Certificate has been revoked' });
 
-    const baseUrl = `${req.protocol}://${req.get('host')}`;
+    const baseUrl = process.env.BACKEND_URL ?? `${req.protocol}://${req.get('host')}`;
     const buildUrl = (f) => f ? [generateSignedUrl(baseUrl, path.basename(f))] : undefined;
 
     const response = {
diff --git a/controllers/qualificationController.js b/controllers/qualificationController.js
index dfe6ae2..296df1f 100644
--- a/controllers/qualificationController.js
+++ b/controllers/qualificationController.js
@@ -141,7 +141,7 @@ exports.apiVerify = async (req, res) => {
     if (!qual) return res.status(404).json({ error: 'Degree not found' });
     if (qual.status === 'revoked') return res.status(404).json({ error: 'Degree has been revoked' });
 
-    const baseUrl = `${req.protocol}://${req.get('host')}`;
+    const baseUrl = process.env.BACKEND_URL ?? `${req.protocol}://${req.get('host')}`;
     const buildUrl = (f) => f ? [generateSignedUrl(baseUrl, path.basename(f))] : undefined;
 
     const response = {